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Further to the Executive Committee’s approval of a Data Analytics Strategy in 
November, 2015, this presentation: 
— Provides a progress report on the Data Analytics initiative. 
— Seeks approval of a high-level business case for investments over three fiscal 
years. 


Our vision is to transform the Agency's capacity to drive better outcomes and 


decisions by moving from a siloed to an enterprise approach to data analytics. 


In alignment with the approved § 


the Agency's existing investments in analytics and to propose a funding 
strategy for priority foundational initiatives. 
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The Data Analytics Strategy is strengthening the CBSA’s capacity to deliver a “border of the 
future” that will be faster, cheaper, and more secure. 


* Securing Canada’s borders 
— Taking advantage of advanced analytics to “push the border out" and to enable interdiction of high-risk 
travellers and goods as early as possible in the continuum: | 
— Supporting effective and integrated enforcement at ports of entry, as well as more effective inland 
enforcement and criminal investigations. 


° Streamlining the border experience 
— Providing a seamless experience at the border for low risk travellers and goods, with little or no interaction 
with border officers. 


— A Maintaining comprehensive interaction data on all travellers and goods in real-time Нанын the 
continuum, allowing the Agency to better predict future patterns. 


° Management excellence 
— More timely, reliable, and accessible data to support the Government's “Results and Delivery" agenda; 
— Integrated financial and operational data for resource allocation and business enhancement; 
— Secure and efficient release of datasets for Open Government. Mitigation of "Information Integrity" risks 
and improved data integrity for OAG audits, internal audits, and evaluations. 
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« An integrated, enterprise approach based on increasing our maturity above industry 
standard over next three years. 


* Governance Structure. Provide an Agency-wide approach to decision-making on 
E data issues. | | 
Data * Stewardship. Designate data stewards and centres of expertise, with clear roles and 
Governance responsibilities. | 
* Standards and policies. Implement common definitions, data quality processes, and 
an enterprise data model. 


* Data integration. Build an integrated data warehouse, drawing on key data from 
multiple sources. 

* Self-service. Enable quick access to key reports and data. | 

* Competency Centre. Create a Business Analytics Centre within ISTB for cross- 
functional support and coordination. 


* Data acquisition. Provide analysts with access to key data from internal and 
external sources. 

* Emerging tools and techniques. Explore potential for predictive analytics, 
visualization, and other advanced tools. 

* Workforce development. Recruit and develop high-skilled analysts. 
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2016-2017 | 2017-2018 2018-2019 


| Business 
intelligence 


) Advanced 
| Analytics 
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Completed: 
v E asses VP-led Information Management Committee and working groups. 
v Completed Data Quality Assessment with participation of all branches. 
4 Completes first phase of the CBSA Business Data Model, 


in Progress: 
* Initiated data inventory to meet 2016 Open Government Directive obligations, 


* Began phase 2 of the CBSA Business Model - common Agency data concepts, definitions, and 
ownership. 


| Completed: 
vC Completed first phase of integrated Data warehouse (IDVV) high-level requirements. 
V. Transferred CMRS team to ISTB in order to build Data Services Sepang 


in Progress: 
* Initiated SLMF process for the Integrated Performance Reporting (IPR) initiative, 
* Continue to establish Data Services functions within ISTB. 


Completed: 
v Completed in NTC and demonstrated business value. 
v Completed first pilot of predictive analytics for traveller targeting. 


in Progress: 
* National Targeting Centre (NTC) and Science & Engineering in ISTR continuing to conduct pilot projects 
of next generation technologies. 

* Several pilots underway: predictive analytics for advanced statistical tools 

and information visualization for situational awareness. 

* Working with B5 partners to develop “community of practice" on analytics. 
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E The “Tooth to Tail exercise" identified over 225 FTEs at NHQ which support the performance reporting 
and analytics function. A further 50 FTEs carry out this function in the regions. 


в This is the core community which depends upon the quality and accessibility of performance data, and 
which will be asked to make “in-kind” contributions to the Data Analytics initiative. 


« Within this community, the existing centres of expertise include: 


ince and integra 
ance reporting 


Enterprise Architecture and © Leads Open Data initiatives, manages FTEs: 5 analysts, plus contractors 
Information Management (ISTB) intake for new analytics requirements, 
architecture, and service alignment 


n pilots - 


National Targeting Centre Data Analytics Unit focuses on tactical FTEs: 14, plus contractors 
(Operations) | targeting analytics, leads collaboration 

with B5 partners on operational 

analytics 


. Data Exploitation team deploys basic FTEs: 2 
à analytics. _  - 


000007 


Potential Business 
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$ 


fo improve the quality and accessibili ity of immigration enforcement data. This bg in = с. ona 
solid data analytics infrastructure. The data governance tools developed to improve detention and removal 
statistics, for example, will benefit other program areas as well. 


some 97 million fravellers per year. k will be essential to imp lemerit this ese before the relevant. 
legislative amendments take force in July 2047. 


Data Metégenient TIE po» for identity ^ ко апа еМа айсы which ae о, approxi mately. 
$30 million for analytics and reporting infrastructure. New deployments based on this infrastructure will be 
released in mid-2016. 


лл, with the Agency's date analytics strategy, within the rélevant Cabinet décurments ee TB 
submissions. Phase 3 of CARM, for example, will require a major investment in analytics 
and revenue generation. 
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Guiding principles: | 
~ Salary: Minimal new requirements in short term. Use new Entry-Exit funding ($410,000), 
internal reallocation, and in-kind contributions where possible (e.g. task forces). Review 
requirements in 2017-18. 


— Capital: | | 
and Budget 2017. Funding will be used to build an Integrated Performance Reporting tool. 


Salary $0.4M $0.8M (TBC) $0.8M (TBC) $2.0M 
O&M $2.3М ` $24M(TBC)  $17M(TBC)  $6.1M 
Capital : $3.0M (TBC)  $30M(TBC) $6.0M 
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Key Requirements, 2016-17: 


1. Data Governance Centre 
* Consistent data policies and quality standards are a foundational element for both business 
intelligence and advanced analytics. 
* This work is essential for launching the next phase of the Entry-Exit project and for improving the 
quality of detention and removals statistics. 
° Funding is required to build a data stewardship network and resolve data integrity issues in support of 
the Agency's priorities. 


2. Business Data Model 
+ Provides common definitions for use across the Agency's data. First two phases were completed in 
2015-16 using a "tiger team" approach. 
° Funding is required to provide expertise for development of the next phase of the Business Data 
Model. Initial focus on Immigration Enforcement and Entry-Exit. 


3, Open Government Coordination Office 
* Located in Open Government and Data Services Division, ISTB. 
* Funding is required to achieve compliance with the TBS Open Government Directive, including 
completing the CBSA Open Government Implementation Plan 2016 and a data inventory. 
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| 4. Data Governance 


| Centre (DGC) 


| Programs 


2. CBSA Business 
| Data Model 


ISTB 


| Coordination Office 
| (0GCO) 


| ISTB 


Establish Data Stewardship 
Network and DGC 
Entry Exit and 


Master Data governance 


Salary: $120,000 , 3 FTEs (E/E) 
| O&M: $400,000 (AVRR) 


| « Initial CBSA Business Data 


Model complete 


|^ Next phase: 


ORME — — $400,000 (AVRR) 


Complete data inventory 
Open Government 
Implementation Plan (OGIP) 
2016 Edition | 

Open Data release plan and 
schedule 


$250,000 (ISTB) 


+ Develop Data and Qualif 
Control Standards 
* Operationalize DGC 


| Salary: $240,000, 3 FTEs 
| O&M: 5200000 


Operationalize CBSA 


Business Data Мосе! 
integration of Model into 
prioritization and planning of 
al 


O&M: — $200,000 


Release planning of data 
sets 

Open Information release 
OGIP 2017 Edition 


| O&M: — $250,000 


* Continued impr 


ovement 


and stabilization of 
services 


$200,000 


* Ongoing 


Salary: $240,000, 3 FTEs 


operationalization and 
improvements 


O&M: 


$700,000 


Ongoing proactive 

release of data and 
information 
QGIP 2018 Edition 


O&M: 


$100,000 


Sal. $600,000 
| O&M: $800,000 


OEM: $700,000 | 


O&M: $600,000 | 
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Key Requirements, 2016-17: 


1. Integrated Data Warehouse 
+ Repository for the Agency's key data, including financial and operational data. 
« Funding required to organize this data according to a service oriented architecture. 


2. integrated Performance Reporting 
s User-friendly tool for access to the integrated data warehouse. 
• Linked to replacement of obsolete “G11” data collection system. 
• Sponsored by Programs, Corporate Affairs, Comptrollership. 
* Funding required to prepare costing for Investment Plan (2017-18) and Budget 2017. 


3. Immigration Data 
• CBSA’s immigration-related data resides in the IRCC data warehouse. 
e Funding required to develop detailed plan for integration into CBSA’s data warehouse. 


4. Business Analytics Competency Centre 
EE Funding required to provide leadership within ISTB on analytics requirements, training, and 
implementation. 
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(311 system is a key “feeder system” fo 
integrated performance reporting. 


Existing G11 System: 


% 


Potential Replacement: 


РА 


à 


Built in 1988 (now "End of Life", no 
changes possible). 

Only source for key data (e.g. total 
traveller volumes - 97M / year). 
Contains obsolete, duplicate, inaccurate 
data. 


| 


ў 


Simple “data collection app”. 
Facilitates consistent data entry and 
timely updates, 

Provides cost avoidance at POEs (less 
manual collection). 
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2018-19 


iterative contribution through 
new initiatives 

| + Begin integrated service 

| delivery 


sed 
on common data requirements 
from inflight projects 

» Establish service oriented 
integrated data service delivery 

* Initial focus on immigration 
enforcement data 


stabilization of integrated data 


Warehouse Ша 
Services 


ISTB 


| O&M: $220,000 


O&M: $100,000 (AVRR) | 
| * IT демі. cost (projects) 


+ iT devi. cost (projects) 


O&M: $220,000 
+ IT devi. cost (projects) 


| O&M: $540,000 | 


E Project launch and > Project implementation and - 


2. Integrated IPR | 
Performance implementation iterative delivery 


Reporting (IPR) 


and G11 replacement 

|^ Complete investment proposal 

| and business case 

|* Seek capital investment funding 
| for 2017-18 


Programs 
Corporate Affairs 
Complrollership 


OM -- 


|O&M: — 
| + capital ask (est. $3М) 


+ capital ask (est. $31) 


| O&M: $250,000 | 


O&M: $250,000 (AVRR) 
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| Initiative / Lead 


3. Integration of 
Immigration Data 


Programs 
і5ТВ 


4, Business 
Analytics 
Competency Centre 


| ISTB 


2016-17 


Renuirement definition with RCC 
Planning and feasibility including 
legislation and policy assessments 
Prepare data sharing agreements 
Detention and removals reporting 
enhancements 


| O&M: $250,000 (AVRR) 
* IT devi (RCC) 


Develop service model 

Develop Data Acquisition plan and 
begin implementation 

Lead Geospatial analytics 
Develop training program 
Analytics technology roadman and 
architecture 


2017-18 


Data sharing agreements 
Amend MOUs as required 
Begin data integration 
Report development on 
Detention and Removals 
analysis 


2 O&M: $125,000 


+ IT дем. (IRCC/CBSA) 


Execute Data Acquisition plan 
including privacy and security 
assessments 

Lead geospatial analytics 
implement training program 


| Salary: $200,000, 2 FTEs 


O&M: $350,000 + IT devi. 


2018-19 


E Continue gata 


integration and 


| ORM: $125,000 O&M: $500,000 
| + IT дем. (RCC/CBSA) 


° Service refinement and 
stabilization 


Salary: $200,000,2FTEs | Sak $ 500,000 
O&M: $350,000 + IT devi. O&M: $1,120,006 


Total: $895, 000 
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Key Requirements, 2016-17: 


1. Operational Analytics 
• Strengthened capacity for analytics in the National Targeting Centre and intelligence operations, including 
irregular migration and immigration enforcement. 
• Funding required for detailed planning, architecture, technology improvements. 


2. Program Optimization 
* Support required for Science and Engineering's predictive analytics pilots 
| and development of recruitment strategy for data scientists. 
* Funding also required for Science and Engineering work to support Entry-Exit 


3. Daía Acquisition 
° Funding required to develop acquisition strategy (for both internal and external data), and to resolve 
security and privacy issues. Essential support for operational and program analytics. 


4 Geospatial Analytics 
. Funding required to conduct pilot in to review 
best practices within the Public Safety portfolio, and to prepare a business case and costing. 
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The CBSA is actively using data analytics to fulfill its mandate to support pre-arrival risk 


assessment leveraging commercial and traveller data bases, social media, geospatial 
information, and operational models. | 


Examples include: 


— Predictive analytics models to improve traveller and commercial targeting and strengthen 
intelligence/investigation leads. 


— Analyzing open source data (social media) to conduct tactical inbound air traveller risk assessment for 
national security; incorporating text analytics (terms/phrases), image analytics, and extremist web sites as 
identified by Public Safety partners. 


— Using statistical analysis, data visualization (Geospatial, temporal) as well as other techniques 


— Operations research to improve scheduling of Border Service Officers and resource allocation. 


bees 
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e 
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ation 


Initiative / Lead 


1. Operational 
Analytics 


Operations 
ISTE 


2. Progra m 
Optimization 


Programs 
ISTR 
Human Resources 


2016-17 


Technology optimization — 
leverage existing investments 
Develop requirements for 
operational environment 
Planning, architecture and 
desian 

Focus on Entry-Exil ; 


Salary: $ 90,000, 2 FTEs (E-E) 
ORM: - 


pilots, including Entry Exit. 


Develop recruitment strategy for 
data analysts, as part of CBSA's 


People Strategy. 


Salary: $100,000, 2 FTEs (E-E) 
O&M: - 


2017-18 


Expansion of analytics in multiple 
operational lines: situational 


awareness, investigation, 
intelligence, enforcement 
Resource alignment and 
development of analytics 
expertise 


Operational analytics environment 


implementation 


Salary: $180,000, 2 FTEs 
ORM: $240,000 


+ IT infrastructure and development 


cost 


Begin operationalizing data 
science advancements 

` Recruit and train new data 
scientists 
identify new opportunities 


Salary: $200,000, 2 FTEs 


ORM: $80,000 


2018-19 + 


Operational analytics 
environment implementation 
Continued workforce 
development and 
improvement 


Salary: $180,000, 2 FTEs Sal: 
O&M: $240,600 
+ IT infrastructure and 
development cost 


development and recruitment 


Salary: $200,000, 2 FTEs | Sal: 
| O&M: $80,000 | 


$450,000 


O&M: $480,000 


$500,000 
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2016-17 2017-18 2018-19 + 
3. Data Acquisition Develop strategy and plan * Execution of data acquisition plan f * Continued data acquisition 
| « Prioritization of data sources * Task force action plan - execution. f * Continued security and 

| * Establish task force for security privacy assessments as 
and privacy impact assessments required 
(DSO, ATIP, Programs, 
Operations) 


initiative / Lead 


| 1578 


| O&M: $200,000 
* IT development cost 


O&M: $100,000 


* IT development cost DRM USTED 


O&M: $400,000 (AVRR) 


4. Geospatial Architecture and design | * Implementation and delivery 

| Analytics * Technology procurement 
* infrastructure design and 

implementation 


* Review use by Public Safety 
partners 
* Prepare business case and 
| costing 


| (STB 
| Operations 


| OM: $150,000 (AVRR) O&M: $200,000 
* technology procurement and IT 


| devt. cast (CBSA, SSC) 


ОЗМ: $200,000 
* technology procurement and IT 
devt. cost (CBSA, SSC) 


O&M: $550,000 


000020 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


850,000 | $895,000 $895,000 $2,640,000 
intelligence + capital (est. + capital (est. + capital (est. 
$3M) $3M) Xe" 
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= ébrifiätion à Management Committee (quarterly). 
— Executive Committee (December 2016). 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


June 2016 
Programs 
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4 Introduction: 


1.4 Background 


The World Customs Organization (WCO) has declared 2016 as the year of “Digital Customs — 
Progressive Engagement” as a way to bring world customs organizations together and share 
experiences, best practices, and promote the digitization of customs processes. See Appendix 
A for WCO Release. 


By promoting the digitization of customs, the V/CO hopes to recognize that the digitization of the 
Customs landscape leads to improved data collection and the expanded capability to exploit 
data that improves processing, promotes transparency, identifies risks, and better integrates not 
only border processing activities but greater law enforcement activities as a whole. 


The WCO has asked CBSA a fairly simple, but broad question “What does big data mean to 
CBSA?” in its effort to bring our experience to the table on one of the newest emerging concepts 
of data usage called "big data". There are three key principles of big data (Gartner, 2001): 


oe Volume - The quantity of generated and stored data available to base decisions on. 

e Variety - The breadth of data that is available to the decision-making process. 

+ Velocity - The speed at which data is created and integrated into the decision-making 
process. 


Methodology 


As the concept of “big data” is still emerging and not necessarily well understood, the Global 
Border Management Data Analytics Division (GBMDA), within Programs Branch, proposed a 
questionnaire to the Data Analytics Working Group (DAWG)' to help answer the question "What 
does big data mean to CBSA?" as well as identify the current footprint of big data within the 
CBSA. The intention of the questionnaire was to gain insight into the understanding and 
execution of "big data" within the CBSA and reach a conclusion that would answer the question 
posed by the WCO. A high-level survey was distributed to the Advanced Analytics Sub-Working 
Group members, which is a sub-working group under the DAWG, and the responses compiled 
are consolidated in this document, The questions included in the survey are available for 
reference in Appendix B. 


"The DAWG comprises a broad collection of directorates that are instrumental in shaping and improving the data 
footprint ofthe CBSA 
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2.1 


What is big data at the CBSA? 


At the CBSA, big data is understood as any work leveraging high volumes of data, including 
historical and transactional data. Big data is seen as a core enabler within the CBSA, supporting 
policy decisions and threat assessments. 


The CBSA collects data from both internal and external sources. Internal data sources include 
(but are not limited to) transactional data, examination data, CCTV video streams, volumetric 
and scheduling data, commercial and traveller data. Externally, the CBSA takes advantage of 
open source data and external situational awareness data. 


The majority of big data work currently done at the CBSA focuses on analyzing high-volume 
structured data, while future-facing efforts are being made to align the Agency’s analytics 
capabilities with the broader definition of “big data”, making use of not only the large volumes of 
data but taking into consideration variety and velocity as well and efficiently use it to address 
complex problems. 


2.2 How is big data being used? 


The CBSA is taking advantage of internal and external data assets to gain better insight to 
support its facilitation and security mandate. The National Targeting Center (NTC) is currently 
using big data to identify high risk travellers and goods. 


The Advanced Analytics team within the Information, Science and Technology Branch (ISTB), is 

leading multiple big data pilot projects to enhance predictive analytics, information visualization 

and improve the use of the Agency's biometric data. That team benefits from access to the 

Science and Engineering Directorate's Experimental Computing Environment which allows the 

Advanced Analytics team to tailor software and hardware to any given piece of work. In addition, 

dá team has access to the procured enterprise tools that also provide a suite of advanced data 
ini ning capabilities, 


An Enterprise Data Warehouse (EDVV) currently exists and brings together information from 
various data sources of mainly internal data for data analytics. The EDW is currently being used 
to support our targeting operations in the interdiction of travellers and goods prior to their arrival 
at a port of entry (POE). 


in the commercial realm, project funding has served as a catalyst to advance the analytics 


within the CBSA. Advanced analytics are used in the commercial program to identify and 
intercept high risk shipments and improve targeting. 


2.3 Challenges 


The current landscape of big data at the CBSA is truly just beginning and the common 
understanding and execution of big data generally involves putting together large volumes of 
data from disparate sources. Further leveraging big data will require addressing challenges 
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linked to data acquisition, workforce development, data management, and systems 
infrastructure. 


Accessing data in a timely fashion has been identified as one of CBSA’s biggest issues with 
respect to big data. Privacy limitations across jurisdictions make data acquisition for horizontal 
reporting difficult. In some cases it can take years to receive a sizeable dataset for experiment 
purposes. 


Uniocking the potential for big data usage will require strategically developing our workforce by 
identifying high potential data analysts that can be hired early in their career and grow 
professionally inside the Agency. it will also require enhancing current employee skills and 
capacity through further training and access to analytical tools. 


systems acquisition is required to make processes more efficient. Currently, this function is 
decentralized which leads to inefficiencies due to a lack of standardization of processes. The 
Agency intends to operationalize the Business Analytics Competency Centre (BACC) within the 
ISTE to act as the single point of contact to lead and facilitate the implementation of data 
analytics services. Efforts to improve data management through implementing data governance 
and stewardship will aiso alleviate some related issues in the mid-term. 


The current enterprise approach to system infrastructure makes it difficult to expand on the 
analytical capacity of the CBSA. Further integration of data across the Agency is necessary to 
improve our ability to risk assess both goods and people. The CBSA must move towards an 
Integrated Data Warehouse (DW) to replace the existing EDW. 


2.4 


Moving Forward 


To gain maximum value from the Agency's big data efforts, work must be done to promote 
further integration of data. The Agency must also focus on minimizing barriers to access and 
broadening the EDW. | 


Development is continuing on the existing EDVV to integrate additional sources and types of 
information. Very recent additions to the EDW include open-source data sets that will improve 
our ability to risk assess both goods and people. Additional proiects are in the exploratory 
phase that will bring together biometric screening, facial recognition, automated lie detection, 
and predictive modelling to the traveller screening process and feed into our big data footprint. 


By integrating large datasets into the EDW and expanding access, the CBSA will gain greater 
insight into big data. This will lead to actionable predictions on high-risk goods and people, 
including previously unidentifiable relationships. 


Moving forward, the Agency must treat data as a corporate asset if we are to leverage big data 
to its full potential. In an effort to formalizing data governance within the Agency, governance 
bodies such as the Information Management Committee (MC) and the DAWG have been 
established which constitute a positive step towards recognizing the importance of data in the 
Agency. 
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SA? 


Big data presents an emerging opportunity for the CBSA to fulfill its mandate in a more efficient 
and effective way. By taking stock and making use of all available, relevant sources of data in 
near real-time, the CBSA will be in a better position to make informed, evidence based 
decisions that will improve facilitation and security processes at the ports of entry. While the 
value of big data is acknowledged within the advanced analytics community within the CBSA, 
leveraging big data to its full potential will require addressing some key challenges at all levels 
of the Agency. | 


3 Conclusion - What does "big data" mean to CB 
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Andrei Grushman 
Director, Data Analytics 
Programs Branch 


Erica Ren 
Director, Open Government and Data Services 
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4 Appendix À — WCO News Release 


organization 4leclares-2016-to-be-the-vear-of-didaital-customs.aspx 


Source: hito www. wcoomd.orda/en/medialnewsroom/züd15/november world-customs- 


World Customs Organization declares 2016 to be the year of Digital Customs 


The Secretary General of the WCO, Kunio Mikuriya, announced today that 2016 will be 
dedicated to promoting the digitalization of Customs processes under the slogan "Digital 
Customs: Progressive Engagement." WCO Members will have the opportunity to showcase and 
further promote their use of Information and Communication Technologies (ICT). 


The term Digital Customs refers to any automated or electronic activity that contributes to the 
effectiveness, efficiency, and coordination of Customs activities, such as automated Customs 
clearance systems, the Single Window concept, electronic exchange of information, websites to 
communicate information and promote transparency, and the use of smart phones. 


This new era of Digital Customs has transformed the way that Customs operates. Ultimately, it 
ensures progression — the enhanced ability of Customs Administrations to communicate, 
process goods, receive and exchange information, coordinate border activities, collaborate on 
law enforcement actions, and promote transparency. Improved technologies thus have the 
ability to positively impact and transform the Customs landscape through: 


* improved compliance as a result of increased access to regulatory information and functions, 
as well as services, on the part of all international trade stakeholders; + Faster clearance times 
for legitimate trade; 


* Enhanced coordination between Customs units, as well as between Customs and other border 
regulatory agencies at the national and international level; 


e Increased transparency in regulatory processes and decision-making: 


> The use of performance measurement to improve Customs procedures and levels of integrity, 
such as through the techniques presented in the WCO Performance Measurement Contracts 
(PMC) Guide; 


+ Enhanced detection of irregularities and illicit consignments through the collection and analysis 
of data. 


Such positive outcomes will contribute significantly towards the realization of Customs’ 
objectives, including improved revenue collection, border security, the collection of trade 
statistics, and trade facilitation. “Border agencies are increasingly embracing digitalisation to 
enhance their effectiveness and efficiency. 


The WCO has an extensive portfolio of instruments and tools to support WCO Members in their 
efforts to further adopt Digital Customs." said WCO Secretary General Kunio Mikuriya. 


"Over the course of 2016, | invite all WCO Members to promote and share information on how 
they are implementing and using digital technologies to advance and achieve their objectives." 
Mr. Mikuriya added. 
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The WCO's annual theme will be launched on International Customs Day, which is celebrated 
annually by the global Customs community on 26 January in honour of the inaugural session of 
the Customs Co-operation Council (CCC) which took place on 26 January 1953. 


The WCO invites the Customs community to mark 26 January 2016 in their diary. 
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re 


The purpose of this questionnaire is to solicit input for a VVCO request to CBSA on our 
development, use, and challenges of big data, with regards to policy and IT. 


2016 has been named the year of "Digital Customs — Progressive Engagement" by the WCO 
and in an effort to promote CBSA and share best practices and procedures with other WCO 
members CBSA has been asked to provide some introductory information on our “big data" 
footprint. 


To help showcase CBSA's big data technical and application expertise and how it integrates 
into our big data network please provide feedback, where applicable, to the following questions. 


1. What does big data mean to your area of CBSA? 
2. How, in your area is CBSA applying the characteristics of big data? 
3. What sources of data does your area consume from CBSA? 


4. What sources of data does your area consume from external sources? (provide 
examples and how they integrate with internal CBSA data, please) 


5. Does your area consume any sources of unstructured data? 


86. What big data technical solutions are currently being employed in your area? (trial or 
established) 


7. What are some ways you feel CBSA could improve its execution of big data? 


8. What is that largest difficulty your area faces with respect to big data 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


Executive Committee 
November, 2015 


Programs Branch 
information Science and Technology Branch 


PROTECTED A 
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e Outline a vision for CBSA’s Data Analytics Initiative to transform the Agency's 
capacity for data governance, business intelligence, and advanced analytics. 


e Seek approval for a 3-year action plan and governance framework. 
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Data Analytics is an integrated approach to gathering, organizing, and using our data. 


Data Governance 

* Common management, principles, 
roles and responsibilities across an 
organization 

* Standard definitions, processes 


Business Intelligence Advanced Analytics 
* "Integrated" data for dashboards, reports + “Raw” data for power users 
* Drawn from internal CBSA sources e Internal and external sources (“Big Data") 
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The Data Analytics Initiative’s goals are closely aligned with the Agency’s strategic objectives: 


e Securing Canada's borders 


—  Strengthened capacity to use analytics for targeting, intelligence, operational awareness 


a Streamlining the border experience 


v 


improved access to quality data for program design, client service, and revenue generation 


e Management excellence 


— 


More timely, reliable, and accessible business intelligence for performance reporting and decision-making 
— integrated financial and operational data for resource allocation modelling 
— Secure and efficient release of datasets 


This initiative is driven by the need to build a culture of analytical excellence. It seeks to mitigate 
the "information Integrity" risks highlighted in the CBSA's Enterprise Risk Profile. 
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ASFC - Divulgation en vertu de la loi 


000036 


to Information Act 


‘Accès à l'in 


0 
sur | 


formal 


tion 


à Sata D ОТРУТ | ЫЗ a - i B "3 za ч. E N, eo - зер 
А Data Repositories and d Ш sn À POWER | FOR Yo petite ostia My MER 
ТЕ FD e< Hi Я j t 2 p 


Reporting Svstems 
f @ 


ps Higgs 
iuda 
Warne 


K 353 E 52 


€ 


X, Data Моше j #1 mend À 
X. zs F P Curnere T 


ESSE 


Ў, P ; i 
Ysa it REVS |: 
Dee Е 5 


^ be 
К ann 


Dot Weg tion Deep Di Thy Pedreira hasse Mens Fas рх ралоо Feria UGE IM sod Bohs eds oon Fere MA, Pas qz Pee f TEAK 


We cannot fulfil our mandate without 
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data to drive our priority-setting, decision- 


making, performance measurement, 
budget planning and forecasting, and 
operations. 


CBSA is a data-rich organization, with 28 
terabytes of Information from over 130 
internal data systems alone. 


Agency needs to maximize the value of 
this data by moving away from current 
siloed, manual and outdated approach. 


We need to recognize that our data is a 
corporate asset and its management is a 
shared responsibility. 
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Conduct budgeting and forecasting analysis for better resource management and 
ensure required resources are in place to meet future demands. | 


Performance 


Management 


e Me ORR AA VAS Re Ave М ی بی‎ we a А ма ды A Мн یت‎ 


Statistical 
Reporting 


Operational 


Align operational and program performance indicators, and measure and monitor 
program effectiveness through tracking those Indicators. 


ААА ЧАА A САА AA AN A Au ААС SOE SAP ЧАА OAM ee МА ane М ہی‎ OE АР ہپ‎ ERROR CCR Ne OU чең CR AR me ee eee Re чт» eur Ou RR RE OO уе че oe 


Perform statistical analysis on trends in program performance over an extended 
period of time to drive deeper understanding of key areas, e.g. traveller volumes, 
revenue collected. 


WO O оо Өх эх MK CRI бз Мы em RA АДС ИЛӘ ЛАР р eo re UN reo et ҸАР ҸАР “тт ERORO ee ҸАР чле чер чл te ere ee 


Leverage data in a consistent and efficient manner to gain a clear understanding of 
“what happened” and “what is happening” across the CBSA to better manage day- 
to-day operations: 


Operational 


“л элд лл NN ММ ААР МАР блр ҸАР ҸАР АА А АА ому CAN AN ААР “лә A me 


Integrate internal and external data to conduct advanced analytics in real time (e.g. 
predictive analytics) in support of targeting, intelligence, enforcement, and 
threat/risk assessment. 


AM ля a ААС ААБ ляк Ар ААР зли чия oa O i inl Әф RD RD E OM N O E е К AL А AS AA ANT AR AR AS A е МА ع ا ا‎ МАА RR ع‎ МАА ا ا‎ A AP AN A МР OE М чч AS ا ا ع‎ OE ا‎ А م ع‎ А a NAN AA RAR الم‎ PEER АФ КӘР XR اه‎ dM Эр} ои p н ae a né юш 


Apply analytics to improve program design and transformation, e.g. resource 


allocation, trade fraud detection, revenue management. 
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_ Programs 


and reporting service, Consolidated 
- training and support 
grity unit - risk assessment 


Operations | Corporate Affair 
>N perations Centre — applied 
analytics in support of targeting, situational 
awareness, operational intelligence 
> Regional Corporate Program Support Divisions 


utetur | r с jen 


Human Resources 
 * HR Programs — workforce analysis (e.g. 

. . demographics, time utilization) and link to 

People Strategy 
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Data Fusion initiative launched by PPC in December 2014. 
Committee and working groups established in February 2015. 
~ Focus on governance, collaboration, enterprise basics 
Maturity assessment in April 2015 found Agency is below the industry average, with 
some significant gaps including: 
~ No enterprise business analytics strategy 
~ Operational intelligence data and tooling challenges 
~ Performance reporting highly fragmented and manual 
Advances made in managing data 
— еМапіѓеѕї, Entry-Exit, CARM and other projects building data analytics components 
— National Border Operations Centre use of API/PNR, cargo and release information, social media 
~ Science and Engineering team piloting the use of predictive analytics for Traveller targeting 
— Web Dashboard prototype for user-friendly access to data 
~ Open Government Implementation Plan, release of six datasets 
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e An integrated, enterprise approach based on increasing our maturity 
above industry standard over next three years. 


* Governance Structure. Provide an Agency-wide approach to decision-making on data issues, 

e Stewardship. Designate data stewards and centres of expertise, with clear roles and 
responsibilities. 

* Standards and policies. implement common definitions, data quality processes, and an 
enterprise data model. 


* Data Integration. Build an integrated data warehouse, drawing on key data from multiple 
SOUfces, 

» Self-service. Enable quick access to key reports and data. 

s Competency Centre. Create a Business Analytics Centre within ISTB for cross-functional 
support and coordination. 


e Data acquisition. Provide analysts with access to key data from internal and external 
sources, 

* Emerging tools and techniques. Explore potential for predictive analytics, visualization, and 
other advanced tools. 

* Workforce development. Recruit and develop high-skilled analysts. 
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Performance 
Reports 


Program stats 
and analytics 


Advanced 
Analytics 


H 
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From 


Business intelligence 


e 


Producing reports is labour-intensive, 
prone to error and difficult to repeat 


Manual integration from variety of sources. 


Gaps in data collection 

Data housed in CIC Data Warehouse. 
Financial, human resource, and operational 
data not integrated 

Overlap and duplication in analytics work 
undertaken by major projects 


To 


* Integrated Data Warehouse automates 
PMF, APS, and Cost Factor Manual. 

e User-friendly access to reports and power 
users have self service 

» Operational, financial, and human resource 
data are integrated into data warehouse 

* Full integration with Service Life Cycle 
Management Framework 
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To 
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Key Roles 


Vice President, ISTB. TBS-mandated role as Information Management Senior Official. 
Duties include delegated authority to approve release of Open Government datasets. 


All Branches. Shared responsibility to manage Agency’s data as a corporate asset. ISTB 
manages enabling technology and processes. 


New “Information Management Committee” 

+ Co-chaired by two VPs [TBD]. 

« Approves strategies, policies, and processes for 
management of information and data. 

+ Collaborates with other VP committees. 

* DG representatives from all Branches. 

e Working groups and consultative network, 

* Merges existing Data Fusion and IM Initiatives 
steering committees. 


E-mail Transformation | Data Governance, 
initiative, Apolin, Web Advanced Analytics, 
Renewal Business Intelligence 
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Business Case 
To date, the direct costs have been covered by Programs Branch and ISTB. 
Funding on project-by-project basis received from multiple sources, such as 
Refugee Reform, eManifest, and Entry-Exit. 
However, full business case to be developed to better track and manage all 
investments and results. 
Funding will be required, including from existing resources, for: 
— Salary and O&M annually to strengthen data governance and support Open Government 
— Expanding our capacity for advanced analytics | | 
— Capital funding to launch the Integrated Data Warehouse 
Business case to be completed by Spring 2016 for EC consideration. 


Integrated into the Agency's business plans and priorities. 


wee 
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Management 


FY 2016-17 


+ **Complete business case 
for next three years. 

+ Alignment with Agency 
business planning. 

* Monitor progress, report to 
PPC/EC every 6 months on 
progress. 

* Intake Process. Define 
intake process for new 
requirements under SLMEF, 


FY 2017-18 


* Annual planning cycle 


* Monitor progress, report 
to PPC/EC every 6 months 
on progress. 


FY 2018-19 


* Annual planning cycle 


* Monitor progress, report 
to PPC/EC every 6 
months on progress. 
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FY 2016-17 


FY 2017-18 


FY 2018-19 
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FY 2016-17 


(c on 


FY 2017-18 


FY 2018-19 
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e 


Decision required: 
— Approve strategy and governance framework 


gency Priorities in FY 2016-17 
— Integrated Business Plan, Capital Plan, etc. 


— People Strategy 


e Progress Report every 6 months 
— Program Policy Committee (March 2016) 


— Executive Committee (June 2016) 
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Agency Drivers 
» Map projects to goals, metrics, data needs (Data lineage) 
» Identify and prioritize which questions need to be answered through 
data analytics 


Data Strategy 
> Implement “big data" platform in a sidecar environment 


> Migrate sample set of data onto the platform 


Analysis & Insight 


Data Strategy 
» Develop use cases designed to support the investment of a big data Drive Change 
platform > Create an analytic center of excellence 


> Conduct ‘big data’ vendor analysis > Create Agency wide transformation model 

» Create “big data” technology roadmap 

> Create a formal data governance framework for the new architecture Measure Results 

> Conduct a policies standards and procedures analysis for the new >» Design high level benefit tracking report which outlines how each 
architecture including data management, quality, usage and issue project contributes to each metric. 
management 

» Conduct a skill assessment for data governance framework 

» Create organizational structure for data governance framework 


Analysis & Insight 

» Help develop use cases designed to support the investment of a big 

data platform 

» Create and test scenarios based on data scientist intuition and 
experience 
Interview Border Service Office to generate hypothesis 
Create direct communication path between the BSOs and the 
advanced analytic team 


VV 


Drive Change 


Measure Results 
» Begin to use analytics to predict the likely outcome of future projects 
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1 Setting the Stage 


е 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


The exponential growth of information, the multitude of in-house systems that generate it and 
the inherent difficulties in capturing the information resources’ actual context (1.e. metadata) has 
made managing the Agency’s information increasingly difficult. 


While methodologies, systems, tools and techniques for managing information have evolved 
over the last decade (within government and beyond), they still fall short of successfully 


harnessing one of the Agency's critical resources, zwformation. 


The current strategy aims to initiate a much-needed paradigm shift of traditional Information 
Management approaches and solutions. The shift can be understood through the following 


table: 


Role of CBSA’s 
Enterprise 
Information 
Management 
(EIM) division 


Approach to 
deliver services 


Valuing corporate 
information 


Achieving proper 
information 
lifecycle 
management 


Methodology 


Information 
Resources of 
Business Value 


Compliance-focused, primarily reactive 
involvement in business processes and 
operations. 


Mandated & difficult enterprise-wide 
solutions. 


(“Thou shalt” mindset) 
All unstructured information treated as 


equally important, making it difficult to 
focus resources and efforts strategically. 


Reliance on unproven and limited 
functionality as proposed by content 
management system vendor. 


Waterfall-centric, multi-year, high-risk. 


Spread across multiple unstructured 


repositories, low-visibility, out-of-context. 


Low usability of the information. 


Proactively involved with business clients 
(as early as planning stage), focused on 
improving inefficient “information flows”. 


Relevant, stable and efficient services and 
tools to business client. 


(‘Business comes first” mindset) 


Risk-based approaches successfully used 
to apply 80/20 principle. 


(Focus efforts on high-value resources) 


Innovative use of a wide spectrum of 
solutions to iteratively and progressively 
develop the Agency’s capability to perform 


information lifecycle management. 
(slowly move yardstick forward) 


Incubation, progressive release, early 
adopters, starting with small changes, 
building up. 


Centralized, highly integrated enterprise 
content management platform, metadata- 
rich. High business usability of 


information. 
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2 Executive Summary 


2.1 Context 
The present strategy: 


e Builds upon the foundational work of the previous deliverable “Information 
Management 2015-2018: A Strategy to Unlock Information Value in the CBSA”; 


e Provides a tactical view of required initiatives to implement the vision; 


° Provides an updated look at the pressures and internal/external drivers of the Agency 


° Includes recommended actions resulting from the Agency internal audit of IM (2015- 
2016); 


° Aligns with the Government of Canada Enterprise Information Management (EIM) 
Strategy. 


2.2 Vision 


The Agency's mission is to ensure Canada's security and prosperity by managing the access of 


people and goods to and from Canada. Its vision is an integrated border agency that is 


recognized for service excellence in ensuring Canada's security and prosperity. 


In support of this departmental vision, the Enterprise Information Management (EIM) program 


is working towards a “New Information Ecosystem” that has the following vision: 


Unlock the value of our information by ensuring al CBSA staff and stakeholders have seamless 
access to the reltable, timely and complete information they need to perform their duties. 


To achieve this vision, the Enterprise Information Management (EIM) division 1s proposing the 


following four Strategic Directions: 


1 A Strategy to Unlock Information Value in the CBSA” Apollo #935722 
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CBSA’s information is 
Managed Responsibly 


CBSA’s information is 
Created and Resides іп а 
managed Eco-system 


Leverage Data to 
Measure and improve 
program delivery 


Connect and 
Empower the 
workforce to succeed 


2.3 Motivation 


Undertaking the proposed initiatives within this strategy will yield positive results and mitigated 


risk: 


1. Provide benefits for key stakeholders 


For the Agency’s workforce: 


м 


м 


м 


An electronic environment that brings efficiency, synergy and collaboration in 
the workplace; 

Increased worker satisfaction; 

Modern electronic work environment consistent with current social and business 
platforms; 


Timely access to complete and authoritative information for service delivery. 


For the CBSA: 


у 
v 
у 


Efficient, integrated and secure electronic processes and information flows; 
Higher quality of information that can be safely shared, used and re-purposed; 
Reduce the amount of stockpiled and mostly unusable electronic information 
and physical paper boxes; 

Financial savings through higher efficiency processes, better life-cycle 
management, dissemination, and elimination of legacy information; 
Information appropriately managed, secured and discoverable to support 


operations, legal and regulatory requirements. 


For Canadians: 


Y Access to publically available datasets; 
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v Efficient government services; 


Y 
v 


Higher control and protection of personal information; 


Contribute to sustainable development objectives. 


2. Respond to current pressures affecting the Agency 


e Internal Drivers 


v 


NL NS. SKS ON 


Aging and deficient information flows and processes; 

Born "Unmanaged"; 

Information Stockpiling; 

Lack of oversight on all of the Agency’s information holdings; 
Limited ability to “crowdsource” and engage the workforce; 
Limited Reach of Information Management support services; 


Difficulty implementing efficient Electronic Records Management processes. 


e External Drivers 


м 


v 


м 


м 


м 


Treasury Board Secretariat (TBS) GC Enterprise IM Strategy and Policy on 
Information Management; 

TBS’s Directive on Recordkeeping prescribed level of maturity; 

TBS’s Directive on Open Government; 

LAC issuance of Records Disposition Authorities (RDA) and information 
disposition requirements; 

LAC no longer be accepting information resources of enduring value created in 
paper format after 2017; 

As of July 2015, LAC no longer stores records that are not of enduring value. 


Boxes of paper have been returned to the originating departments, including 
CBSA. 


3. Responds to the Agency internal audit of IM (2015-2016) 


e The audit reported several findings and issued the following recommendations: 


v 
v 


Further define and communicate IM responsibilities and accountabilities; 
Implement and communicate standard IM tools, guidance and best practices 
actoss the Agency; 

Develop and implement Agency-wide operational and human resource plans for 
IM; and 


Monitor and Report IM on a regular basis. 
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2.4 Strategic Response 


In response, the EIM organization will take concrete actions. It recommends taking the 


following steps: 


У Undergo transformational activities to better position EIM in meeting challenges; and 
V Adopt and invest resources in the four proposed Strategic Directions and resulting 


tactical initiatives. 


EIM Transformation 
At the core of the re-alignment of the EIM Division’s vocation, lies the need 
to refocus efforts and resources towards modernizing and improving IM’s 


ability to facilitate Agency "information flows”. These transformational 


activities will be an integral part of the IM Strategic Roadmap. 


The strategy recommends the following transformational activities: 


Y Perform IM Environment Scan (External and Internal); 
Develop Information Management Service Model ; 
Harmonize IM Functions across the Agency; 


Develop HR Plan and Investment proposal; 


LR AS 


Develop Training & Development Plan. 


Strategic Directions 


The following strategic directions help us understand and organize Strategic and Tactical efforts: 


Facilitate user and management responsibilities through 

CBSA’s information is the creation of an information accountability 
Managed framework that directs the use of Apollo for creating, 
Responsibly using, disseminating, storing and disposing of 


information (e.g. Lifecycle Management). 


CBSA - Enterprise Information Management (EIM) Strategy — Page 8 


CBSA - Released under the Access to Information Act. 


ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


000081 


CBSA’s information is 
Created and Resides 
in a managed Eco- 


system 


Leverage Data to 


Measure and 
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Continue Agency adoption of Apollo, increase 
management of email business information and 
decommissioning of network drives in support of 


Agency business and alignment to GC. 


Mature the Agency’s capacity for data governance, 


business intelligence, and advanced analytics to drive 
Improve program و‎ 
better risk management, enforcement and decisions. 


delivery 


Action organizational culture change through 
Connect and MN | р. 

communications, marketing, апа workshops to facilitate 
Empower the 


the sharing of information and knowledge as a strategic 
workforce to succeed | 
asset for effective border management. 


Strategic Roadmap 


The EIM organization proposes a multi-year roadmap to fulfill the strategic vision for the 


Agency’s new Information Ecosystem. See Appendix A for the complete roadmap. 


3 Background 


This iteration of the CBSA Information Management Strategy builds upon the foundational 
work of the previous deliverable “Information Management 2015-2018: A Strategy to Unlock 
Information Value in the CBSA”. While aligning with the stated goals and framework, this version 
provides a tactical roadmap to realizing the strategic direction of Information Management at 


the CBSA. 


4 Guiding Principles 


Guiding principles represent the philosophy that guides the Agency’s Enterprise Information 
Management organization throughout all circumstances, irrespective of changes in its goals, 
strategies, type of work, or management filter for decisions making. 


^ “A Strategy to Unlock Information Value in the CBSA” Apollo# 935722 
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In defining the latest strategic direction, CBSA EIM observes and adopts principles defined in 
the Government of Canada Enterprise Information Management Strategy, as follows: 


Networked & 


User-Centric Smart 


Enterprise-First Open & Secure 


Collaborative 


MARRE Eee 


5 Value Proposition 


5.1 Information as a Strategic Asset 


Information is a business resource (“ke Human Resources and Finance). Not managing information 
is not a viable option: 
e Information can enable us and overwhelm us. There is such a thing as “Гоо much 
information”. 
e Everything we do within the Agency starts with information and generates more information. 


e The Agency renders decisions every minute using “information” 
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5.2 Benefits 


In working towards this vision, the Agency and its workforce can expect to see several benefits: 


e Дпр electronic environment that brings efficiency, synergy and 
collaboration in the workplace; 

e Increased worker engagement and satisfaction; 

e Modern electronic work environment consistent with current social and 
business platforms; and 

e ‘Timely access to complete and authoritative information for service 


delivery. 


e Efficient, integrated and secure electronic processes and information 
flows; 

e Higher quality of information that can be safely shared, used and re- 
purposed; 

e Reduce the amount of stockpiled and mostly unusable electronic 
information and physical paper boxes; and 


e Information appropriately managed, secured and discoverable to support 
operations, legal and regulatory requirements. 


6 Impetus for change 


6.1 Current State 


The Agency has a relatively young IM program (6 years old) and like most of OGDs, recent 
investments have been made towards compliance to the TBS Recordkeeping Directive and 
establishing the technical infrastructure for supporting tools. The time has now come to shift 


focus to enabling the Agency’s programs and business lines. 


While basic IM services are in place, transformation 1s still required to establish IM as a 


foundational business support service. 


As stated in the Government of Canada Enterprise 


Information Management Strategy: "Information", like 
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financial and human resources represents a critical strategic asset without which federal programs and 


services could not be delivered.” 


Significant resources are dedicated to increasing the maturity of HR and financial management 
across the Government of Canada. Similarly, an enterprise-wide effort and commitment to 


effective IM is needed to maximize the value of information as a strategic asset. 


6.2 Internal Drivers 


As demonstrated in the root cause analysis (see Appendix D), the Agency can report the following 


internal pressures: 


Aging and deficient information flows and processes 

The Agency’s current information ecosystem lacks several core capabilities and integration to 
properly assist our business lines in generating, consuming and purging information in a 
cohesive, sustainable and efficient manner. This creates large information sets that represent 


considerable risks and manual effort to manage over time. 


Born "Unmanaged" 

Too much of our information is “born unmanaged” due to the lack of contextual information 
(e.g. metadata, description, context). This contextual information can come from various 
sources such as host systems/applications, parent process, manually input by end user, default 
values, etc. Without contextual information, as the information ages, it becomes near impossible 
to manage. An efficient information organization must leverage all opportunities to foster 
metadata-rich information as relying on end-users to manually describe information rarely yields 
consistent and acceptable results. This creates a situation where keeping and duplicating 


everything forever becomes the only safe option. 


Information Stockpiling 

There appears to be no solution in sight to end stockpiling of electronic and paper information. 
Paper based information, especially, is ineffective, inaccessible, slows down our business 
processes and is not easily re-usable. As more pockets of information are kept for long periods 
of time, there is a high possibility that we lose track of them entirely (e.g. creator of information 
leaves the Agency, systems or processes are superseded without proper migration or disposition 
of information, etc.). Without the proper ownership and oversight strategy, an organization can 


therefore quickly lose sight of large collections of information (electronic and paper). 
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Lack of oversight on all of the Agency’s information holdings 

The Agency is in possession of significant amounts of orphaned and unmanaged information 
holdings, some of which are decades old. These holdings are discovered on an adhoc bases and 
likely only represent a small portion of our holdings. A formal and thorough approach to 
tracking our information resources must take place. Information also exists in multiple 
unmanaged repositories within the Agency and beyond (e.g. Global Case Management System — 
GCMS — hosted by IRCC). The Agency must be rigorous and work with IRCC and other 
partners to ensure shared information is managed properly and readily available to meet CBSA 


business requirements. 


Limited ability to “crowdsoutce” and engage the workforce 


We are not currently positioned to offer an engaging and collaborative electronic environment to 


leverage the workforce’s collective input, organizational knowledge and abilities (e.g. 
crowdsourcing, capturing and re-using knowledge, etc.). Ensuring information in all formats is 
available as a business resource will increase efficiency and productivity while also supporting 


knowledge transfer of corporate memory. 


Limited Reach 


Enterprise Information Management (EIM) is not sufficiently represented and integrated within 


portfolios to play a proactive oversight role and provide foundational business support. 


Difficulty implementing efficient Electronic Records Management processes 

The approach and solution to information lifecycle management in an electronic document and 
records management environment that has been promoted at the GC level has very limited 
success overall (e.g. at the GC level). The model itself 1s being rethought from the ground up in 


order to find a definitive solution to managing our departmental information. 


6.3 External Drivers 


In addition to internal pressures departments and agencies are expected to comply and policies 


and directives related to information management: 
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e Treasury Board Secretariat (IBS) has provided guidance by publishing the GC 
Enterprise IM Strategy and a Policy on Information Management; 

e [DS's Directive on Recordkeeping dictates a prescribed level of maturity in all 
departments and agencies; 

e [DS's Directive on Open Government which requires departments and agencies to 
maximizing the release of Government of Canada open data (structured data) and open 
information (unstructured documents and multi-media assets); 

e LAC issue Records Disposition Authorities (RDA) which enable government institutions 
to dispose information resources no further business value and requires them to transfer 
records with enduring value; 

e LAC have stated that they will no longer be accepting information resources of enduring 
value created in paper format after 2017; 

e As of July 2015, LAC no longer stores records that are not of enduring value. Boxes of 


paper are being returned to the originating departments. 


6.4 Agency internal audit of IM (2015-2016) 


The CBSA participated in a horizontal internal audit of IM carried out in 2015-2016 by the 
Office of the Comptroller General (OCG). IM was ranked as a high audit priority in the OCG’s 
risk-based audit planning process because it is fundamental to all aspects of government 
programs and services, supports informed decision-making, efficient and effective service 


delivery, and 15 critical to achieving goals and mandate of the government. 


The audit has identified that the Agency has governance and some monitoring frameworks in 
place to support IM; however, IM is currently delivered as a number of initiatives instead of an 
Agency-wide program. As a result, there is an ongoing risk that IM will not be integrated as a 
foundational business support for the Agency’s activities. Opportunities exist to enhance roles 


and responsibilities, accountabilities, procedures, and reporting and monitoring practices for 1M. 


The audit highlighted the following key findings: 


e Governance committees exist and are comprised of management that has the ability to 
influence IM initiatives. While roles and responsibilities were defined and documented, 
additional communication is required to ensure that all stakeholders are aware of their 


responsibilities. 


e IM accountabilities were established for IM committees, the executive level and some 


functional communities, but not for all employees with IM responsibilities. 
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e Policies, guidance, tools and training were developed and accessible to employees. 
Opportunities exist to further implement and communicate standard IM tools, guidance 
and best practices across the Agency to support the consistent implementation of IM. 

e At the time of the audit, operational and human resources plans to support IM were 
under development with a draft anticipated for September 2016. 

e The current monitoring and reporting practices for IM were limited in scope. Expanding 
activities to monitor and report on IM is needed to support oversight and the 


identification of issues requiring corrective action. 
The findings noted above confirm that ongoing effort 15 required to address the gaps 
identified in the 2011 horizontal internal audit of IM related to capacity and change 


management. 


It further made the following recommendations: 


e Further define and communicate IM responsibilities and accountabilities; 

e Implement and communicate standard IM tools, guidance and best practices across the 
Agency; 

e Develop and implement Agency-wide operational and human resource plans for IM; and 


e Monitor and Report IM on a regular basis. 


7 EIM Response 


Direction 


To respond to these pressures, the EIM organization will take concrete actions. The following 


strategic directions help us understand and organize these efforts: 
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CBSA’s information is CBSA's information is 
Managed Responsibly Created and Resides in a 
p managed Eco-system 


Leverage Data to L س‎ ) . . Connect and 
Measure and Improve ) 4 Empower the 
program delivery | ` workforce to succeed 


7.1 EIM Transformation 


To position itself to deliver on these actions and to better meet the new “information needs” of 


the Agency, EIM should consider undertaking an internal transformation. 


Transform & Adapt 
At the core of this re-alignment of the EIM Division’s vocation, lies 
the need to refocus efforts and resources towards modernizing and 


improving the Agency's "information flows”. These transformational 


activities will be an integral part of the IM Strategic Roadmap 


7.1.1 Modernized IM Skills & Competencies 


With the evolving challenges associated with managing electronic information, core 
competencies and knowledge base of EIM resources should follow suit. The agency’s need for 
information services goes beyond traditional recordkeeping. EIM should invest in cultivating 


and acquiring modern and multi-dimensional skills to best support its business clients: 


Key Skills 


° Business Analysis 
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° Process re-engineering 


° Enterprise Content Management & information lifecycle management 
° Information Architecture & Design 

° Collaboration patterns and best practices 

° Electronic Disposition Reporting and processes 

s Change Management & Communication skills 


° Presentation and Negotiation skills 


Knowledge Areas 


° Understanding of critical information flows of the Agency 

° Agency’s repositories, authoritative system of records 

° Present and future capabilities of the Agency's information ecosystem 
° Corporate metadata models and taxonomies 

° Information Governance and delegation structures 


7.1.2 Transformation Activities 


Perform IM Environment Scan (External and Internal) 


Conduct environmental scan to identify gaps in current IM services and verify alignment 
with new Treasury Board GC IM Strategy (2016) (In support of IM MRAP 2.1 — 
30/10/2016) (2months) 

Engage Business Units via the IM Working Group, in the context of influencing the 


strategic direction and identifying challenges in information process, compliance and 


management. (In support of IM MRAP 2.4 — 31/03/2017) (2 months) 


Develop Information Management Service Model 


Develop new IM Service Model and catalogue of services based on required adjustments 
as a result of the environmental scan (In support of IM MRAP 2.2 — 30/10/2016) (1month) 
Develop a captivating marketing and advertising plan for new EIM Services Model (2 
months) 


Integrate new IM Services within enterprise frameworks and processes as required (e.g. 
SLMF) (3 months) 


Harmonize IM Functions across the Agency 


CBSA - Enterprise Information Management (EIM) Strategy — Page 18 


000091 


e Identity and propose common IM functions, job descriptions and classification levels for 
HQ and regions in support of records and information management functions (In support 


of IM MRAP 3.4 — 30/01/2017) (1 month) 


e Introduce the Business Information Agent role (6 months) 


Develop HR Plan and Investment Proposal 

e Proposal to bridge the gap between the current resource base and what will be required 
moving forward. Identify gaps in skills and competencies and propose new competencies 
to address changes in the IM environment (In support of IM MRAP 3.5 — 20/02/2017) (2 
months) 

e Request normalization of the Apollo support team in Gate 7 as the Apollo 
implementation project moves from project status to ongoing state through presentation 
to the Transformation, Innovation and Project Portfolio Committee (TIPP). (In support of 
IM MRAP 3.2 — 30/08/2016) 


Develop Training & Development Plan 


e Identify training opportunities, courses and skills development for existing and new IM 
resources in order to build competencies and skill sets required to support business, and 
ensure usability of information resources in all formats. (In support of IM MRAP 3.6 — 
30/03/2017) 


8 Strategies & Actions 


In order to support the EIM vision, the following strategic directions are defined: 


8.1 Strategic Direction #1: CBSA's Information is Managed Responsibly 


Goal: An information accountability framework that encourage desirable 


behavior in the valuation, creation, storage, use, archival and deletion of 


information. 


Current Gaps 
Operational 


e Regional IM roles and responsibilities are often not acknowledged or defined 
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e Paper / electronic information unmanaged and orphaned 
e Data quality challenge - no identified stewardship roles 


e Data is siloed and inaccessible to most of Agency 


Compliance 


e Lack of information lifecycle management is liability risk 


Value Chain 


Expected Outcome | Benefits 
Y The Agency’s information is treated ! v Improved Decision Making 


and managed as a Strategic Resource у 
8 8 Decreased costs and liabilities 


(like Human and Financial Resource) 


Increased health of the Agency’s 


У Information Accountability, Roles and | . 
information ecosystem 


Responsibility are effectively delegated 


d men | v Strong Management Accountability 


у Agency information in multiple 
repositories is identified and 


accounted for 


Y Increased compliance and efficiency 
through business process 


improvement 


Targeted Actions 


To move towards this strategic direction, the following actions are recommended: 


Y Develop National IM Performance Management & Reporting Framework 
о Design tracking and measuring method for our performance at managing our 
business information holdings 
O Propose and seek IMC endorsement to create framework in order to track the 
management of paper and electronic records 
о Engage Corporate Affairs Branch for guidance and advice in the creation of a 
meaningful IM Performance Management Framework aligned with the Agency 


Performance Summary 
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O Identify key performance indicators for information management well defined 


and monitored 


V Strengthen IM Roles and Responsibilities 
o Review IM Roles, Responsibilities and Accountabilities, establish Information 
and Data Stewardship 
Develop information accountability delegation model 
Develop communication plan 


Present communication plan to EC 


V Perform Information / Data holdings Environment Scan 


O Build a comprehensive Inventory of the Agency's information holdings 


V Continue to work towards compliance to the GC Policy suite 


IM Support for elimination of paper forms 


O GC Recordkeeping directive 
о Implement Open Government Service to Canadian 
o CBSA Open Data Risk Assessment framework 


For further details on these proposed actions, please consult Appendix C — Detailed Action Plan. 


To see the proposed actions in context to overall activities of the strategy, please see Appendix À — EIM Strategic 
Roadmap. 


8.2 Strategic Direction #2: CBSA’s information is Created and Resides in a 


Managed Eco-system 


Goal: Build an engaging experience through an efficient Information 


Ecosystem for the Agency 


Current Gaps 


Operational 


e Network drives, Outlook and local drives currently largest repositories of 


unstructured and unusable information 
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e Multiple stand alone and aging systems 


Compliance 


e Information not managed per Government of Canada regulation 


e Everything is kept forever 


Value Chain 


Expected Outcome | Benefits 

Y Users have access to new value-added ) V The agency's information is richer, 
features easily accessible and re-usable 

Y Older technologies can be phased out | V Access control and collaboration is 
(1.e. network drives) easily achieved 

Y Information is born within a modern |. V Increased user productivity and 
enterprise content management : ٠ efficiency 
plattorm (GC Standard) ٠ У Information Management tasks can 

Y Information is effectively connected : be automated and transparent for 
to a business process. : usefs 


Targeted Actions 


To move towards this strategic direction, the following actions are recommended: 


v Re-launch Apollo for business onboarding and adoption 


О 


О 


О 


О 


О 


Improve system performance 

Simplify information structure and rules 

Transition clients to simplified structure 

Upgrade Apollo to latest product iteration (Content Suite 2016) 


Develop information migration strategy & methodology 


V Optimize business information flows through enabling technology 


O 


O 


O 


O 


Initiate Digitization pilots 
Assess automated metadata tools & auto-classification 
Initiate automated workflows 


Pilot Electronic signature integration 


V Initiate Shared Drive clean-up and shut down 
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O Develop strategy and methodology 
O Work with partners to clean-up and shutdown 
7 Modernize the way we do recordkeeping & information lifecycle management 


Develop Information valuation and Prioritization system 


O 


Develop new Records Disposition Strategy & Process 
O Internal Policy Review & Update 


O 


Strengthen foundational records support by identifying and disseminating 
retention and disposition timeframes across regions for records activities 


O Phase out micro-film in favor of digitized records where feasible 


endix C — Detailed Action Plan. 
endix A — BIM Stratesic 


For further details on these proposed actions, please consult A 


То see the proposed actions in context to overall activities of the strategy, please see A 


8.3 Strategic Direction #3: Leverage Data to Measure and Improve Program 


Delivery 


Goal: Transform the Agency’s capacity for data governance, business 


intelligence, and advanced analytics to drive better outcomes and decisions. 


Current Gaps 


Operational 
e Challenge in accessing data required to perform time sensitive front-line operations 
e Poor data quality affects the Agency’s ability to make the right decisions 
e Limited workforce skillsets 


e Technology challenges 


Compliance 
e Requirement to continuously measure and improve performance 


e Open Government Directive requires proactive release of information and data to 


the public 
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Value Chain 


Expected Outcome | Benefits 
V Effective program delivery У Improved decision-making 
Y Identify opportunities for greater ) Y Increased competitiveness and 
efficiency across Agency | efficiency 


Single version of the truth Reduced Agency risk posture 


Increased opportunity for | V4 Opportunities for cost avoidance and 


organizational learning : savings 


Targeted Actions 


The defined action plans for the Data Analytics Initiative and Open Government Action Plan axe 


summarized as part of this EIM Strategy; for full details and context please see respective 


surrogate documents 
Data Analytics Initiatives: English | French 
Open Government Implementation Plan (OGIP): English | French 


e Data Governance 

v 2016-2017 

O Establish Data Governance Centre 

O Complete Business Data Model - Phase II 

о Launch Open Government Implementation Plan (OGIP) 2016 
v 2017-2018 

о Continue to address data integrity priorities 

о Operationalize Business Data Model 

о Release planning of data and information, OGIP 2017 
v 2018-2019 

O Ongoing data governance, quality control 

O Ongoing maintenance 


O Ongoing delivery of data and information, OGIP 2018 
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* Business Intelligence 

v 2016-2017 
O Establish Integrated Data Warehouse (IDW) 
O Define requirements for Integrated Performance Reporting (IPR) tool, 

including access to the IRCC data warehouse 

v 2017-2018 
O Data acquisition and service delivery 
O Seek capital investment funding, project launch 

v 2018-2019 
O Ongoing data acquisition and service delivery 


O Project implementation and iterative delivery 


* Advanced Analytics 
v 2016-2017 
о Expand operational analytics capacity, e.g. Targeting, Intelligence 
O Complete Program Optimization pilots e.g. trade fraud, API/PNR 
v 2017-2018 
о Implement operational analytics environment 
о Expand data science capacity 
v 2018-2019 


O Ongoing people management, maintenance 


* Open Government 
v 2016-2017 


o Identification and cataloguing of data for Open Government 


O Execute the Agency's Methodology for Establishing a Data Inventory 
O Develop the required tools to support the management of the inventory 


and the publishing of datasets 


O Execute the Dataset Release Plan 

O Develop methodology for the information inventory 

o Endorse and approve new Open Government policies and protocols 

O Propose investment business case for non-structured information 

conversion (1.e. machine readable format) 

v 2017-2018 

O Conduct information inventory and associated Information Release Plan 
v 2018+ 


O Focus on the release of Open Information 
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For further details on these proposed actions, please consult Appendix C — Detailed Action Plan. 
endix A — EM Strategic 


То see the proposed actions in context to overall activities of the strategy, please see A 


Roadmap. 


8.4 Strategic Direction #4: Connect and Empower the workforce to succeed 


Goal: Instill the right values to create a collaborative culture where 
information 1s treated as a strategic asset in support of efficient border 


management. 


Current Gaps: 


Operational 
e Information currently in siloes 


e Outdated business process inhibits efficient business collaboration 


Compliance 
e IM is viewed as an КІМІ responsibility 


e Open Government and Open by Default not part of culture 


Value Chain 


Expected Outcome | Benefits 
Y The workforce operates within | Y Increased productivity and 
collaborative networks ) facilitated operations 


Vv The Agency’s IM culture and behavior Y A high performance information 


is predictable and effective ecosystem 


V The Agency's human resources are Y Increased idea generation, creativity 


empowered with accessible and usable | and knowledge sharing 


information resources 
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Targeted Actions: 


To move towards this strategic direction, the following actions are recommended: 


V Identify and promote collaborative networking opportunities using Apollo 
capabilities 
O Collaboration reference model and patterns 


O Early adopters project 


Y Increase quantity and availability of IM and Apollo training and coaching 
Develop Training Strategy 


О 


Develop a Train-the-Trainer approach 
о Expand power-user training 


O Develop a self-service training/tutorial portal 


V Create Culture Change Management strategy 
о Develop a Change Management Plan that will help improve our 
“Information Culture and Awareness" 
о Establish the IM Guides / Influencer network 


V Increase connectivity and integration capabilities 
o Mobile solutions (Apollo Mobility assessment e.g. Blackberry, Off-site) 
о Apollo business-app integration capability requirements 


O Integration of Apollo to Enterprise Search Capabilities 


For further details on these proposed actions, please consult Appendix C — Detailed Action Plan. 


To see the proposed actions in context to overall activities of the strategy, please see Appendix A — EIM Strategic 


Roadmap. 
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9 APPENDIX A - EIM Strategic Roadmap 


EIM 
Transformation 


CBSA's Information 
Managed 
Responsibly 


CBSA's information is: 

Created and Resides: 

іп a Managed Eco- ; 
system 


Perform IM Environment Scan (External and Internal} 


Develop Information Management Service Model 


Harmonize IM Functions across the Agency 


Develop HR Plan and Investment proposal 


Develop Training & Development Plan 


Strengthen IM Roles and Responsibilities 


Establish Integrated Data 
Warehouse (IDW) 


Leverage Data to 
Measure and 
Improve program + Cataloguing 


delivery : of data for 
| OG 


Connect and 
Empowerthe  : 
workforce to succeed: 


Establish Data 
inventory 


Develop National IM Performance Management & Reporting Framework 


Define requirements for 


IPR tool 


Develop tools to 
support inventory 
and publishing 


Perform Information / Data holdings environment scan 


ce to the GC Policy suite (ongoing) 


2017 


Data acquisition and Seek capital investment Ongoing data acquisition Project implementation 
service delivery funding, project launch and service delivery and iterative delivery 


Dev. Endorse new OG Bus, Case for 
methodology for policies and unstructured 
information protocols info. 
inventory conversion 


Conduct information inventory and Focus on the release 
associated Information Release Plan of Open Information 


Identify and promote collaborative networking opportunities using Apollo capabilities 


Increase quantity and availability of IM and Apollo training and coaching 


Create Culture Change Management strategy 


Increase connectivity and integration capabilities 
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10 APPENDIX B — IM Landscape: Root Cause Analysis 


Information Governan: Lack of Context. Lack of Collab 


Challenges. 


increased 


Loss in 
productivity Limits 
& synergy innovations 


loss of a 3n Difficulty 
Credibility transforming 
; information into 


Decision making 
abilities 
impacted 


Potentia: 
Harm 


Litigation 
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11.1 Strategic Direction 1 


Goal: An information accountability framework that encourage desirable behavior 


in the valuation, creation, storage, use, archival and deletion of information. 
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SD1.1.1 


SD1.1.2 


SD1.1.3 


SD1.1.4 


SD1.2.2 


SD1.2.3 


SD1.2.4 


Develop National IM Performance Management & 
Reporting Framework 


Design tracking and measuring method for our performance at 


managing our business information holdings 


Propose and seek IMC endorsement to create framework in 


order to track the management of paper and electronic records. 


Engage Corporate Affairs Branch for guidance and advice in the 


creation of a meaningful IM Performance Management 


Framework aligned with the Agency Performance Summary. 


Identify key performance indicators for information 
management well defined and monitored 


Strengthen IM Roles and Responsibilities 


Review IM Roles, Responsibilities and Accountabilities 


* Establish Information and Data Stewardship 
* Strong governance and understanding of roles at all 
levels 


Develop information accountability delegation model 


Develop communication plan 


Present communication plan to EC 


Perform Information / Data holdings environment scan 


Build a comprehensive Inventory of the Agency's information 
holdings 


Continue to work towards compliance to the GC Policy suite 


e IM Support for elimination of paper forms 

e GC Recordkeeping directive 

* implement Open Government Service to Canadian 
e CBSA Open Data Risk Assessment framework 


2m 


im 


0.5m 


0.5m 


4m EIMD 


im 


2m 


1m 


12m EIMD 


12m 


Ongoing EIMD 
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In support of IM 
MRAP 4.2 - 
31/12/2016 
In support of IM 
MRAP 4.1 - 
30/10/201 


In support of IM 
MRAP 1.2 - 
31/06/2016 


In support of IM 
MRAP 1.5 - 
31/07/2016 


In support of IM 
MRAP 1.3 - 
31/07/2016 


In support of IM 
MRAP 1.6 - 
30/09/2016 
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11.2 Strategic Direction 2 


Goal: Build an engaging experience through an efficient Information 


Ecosystem for the Agency 
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18m EIMD 
502.1 Re-launch Apollo for business onboarding and adoption 
SD2.1.1 Improve system performance 4m 
SD2.1.2 Simplify information structure and rules 3m 
SD2.1.3 Transition clients to simplified structure 6m 
SD2.1.4 Upgrade Apollo to latest product iteration (Content Suite 2016) 3m 
SD2.1.5 Develop information migration strategy & methodology 3m 


Optimize business information flows through enabling 


SD2.2 23m EIMD 
——— technology 


Initiate Digitization pilots 
SD2.2.1 * Develop Digitization strategy (2m) 6m 
* Pilot #1 (tbd) (2m) 
* Pilot #2 (tbd) (2m) 
Assess automated metadata tools, auto-classification, etc. for 
SD2.2.2 : . 11т 
staged implementation 
* Write Metadata & Rich Description Strategy (2m) 
* Increase the usability and manageability of our 
business information through rich description 
* Metadata capture and generation is automated 
* Common Metadata strategy in place 
* Pilot Auto-Classification Solutions (6m) 


* Pilot Metadata automation Tools (3m) 


SD2.2.3 Initiate automated workflows 3m 
SD2.2.4 Pilot Electronic signature integration 3m 


Initiate Shared Drive clean-up and shut down 
SD2.3 19m EIMD 


Develop strategy and methodology (3m) 
Work with partners to clean-up and shutdown (16m) 


Modernize the way we do recordkeeping & Lifecycle 


D2.4 11m 
302.4 Management 


SD2.4.1 Develop Information valuation and Prioritization system 2m 


e New value & risk based framework and solution for 
electronic recordkeeping 
e Focus on Business/Information Process Optimization 
Develop new Records Disposition Strategy & Process 


SD2.4.2 3m 
Internal Policy Review & Update 

SD2.4.3 3m 

SD2.4.5 Strengthen foundational records support by identifying and 3m In support of IM 
disseminating retention and disposition timeframes across regions MRAP 3.3 — 30/09- 
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11.3 Strategic Direction 3 


Goal: Transform the Agency’s capacity for data governance, business intelligence, 


and advanced analytics to drive better outcomes and decisions. 


The defined action plans for the Data Analytics Initiative and Open Government Action Plan axe 


summarized as part of this EIM Strategy; for full details and context please see respective 


surrogate documents 


Data Analytics Initiatives: LINK 
Open Government Implementation Plan (OGIP): LINK 
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SD3.1 Data Governance 


SD3.1.1 2016-2017 

* Establish Data Governance Centre 

e Complete Business Data Model - Phase 11 

* Launch Open Government Implementation Plan (OGIP) 2016 
SD3.1.2 2017-2018 

* Continue to address data integrity priorities 

* Operationalize Business Data Model 

* Release planning of data and information, OGIP 2017 
SD3.1.3 2018-2019 

* Ongoing data governance, quality control 

* Ongoing maintenance 

* Ongoing delivery of data and information, OGIP 2018 

Business Intelligence 


2016-2017 
SD3.2.1 * Establish Integrated Data Warehouse (IDW) 


* Define requirements for Integrated Performance Reporting 
(IPR) tool 
2017-2018 
* Establish Integrated Data Warehouse (IDW) 
* Define requirements for Integrated Performance Reporting 
(IPR) tool 
SD3.2.3 2018-2019 


* Ongoing data acquisition and service delivery 


SD3.2.2 


* Project implementation and iterative delivery 


Advanced Analytics 
SD3.3 
2016-2017 
SEES * Ongoing data acquisition and service delivery 
* Project implementation and iterative delivery 
2017-2018 
SD3.3.2 : : | 
* Implement operational analytics environment 
* Expand data science capacity 
2018-2019 
SD3.3.3 ' 
* Ongoing people management, maintenance 
Open Government 
SD3.4 


SD3.4.1 2016-2017 
* Identification and cataloguing of data for Open Government 
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* Execute the Agency's Methodology for Establishing a Data 
Inventory 

* Develop the required tools to support the management of the 
inventory and the publishing of datasets 

* Execute the Dataset Release Plan 

* Develop methodology for the information inventory 

* Endorse and approve new Open Government policies and 
protocols 

* Propose investment business case for non-structured 
information conversion (i.e. machine readable format) 


SD3.4.2 2017-2018 
e Conduct information inventory and associated Information 


Release Plan 


2018-2019 
SD3.4.3 e Focus on the release of Open Information 


11.4 Strategic Direction 4 


Goal: Instill the right values to create a collaborative culture where information 15 


treated as a strategic asset in support of efficient border management. 
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SD4.1 Identify and promote collaborative networking opportunities 
using Apollo capabilities 
504.1.1 Collaboration reference model and patterns 1m 


e Make it easier for people to author, share and 
discover information 
e Convenient electronic Team Workspaces 
e Usable document management features 
e Ability to find information throughout all 
repositories reliably 
e Wikis & Discussions 
e Allow people to connect and follow other's social 
business streams 
* Easily find other user's profile and connect 
with them 
e Enterprise Social Pulse (Timeline, Alerting & 
Notification, Followers, etc.) 
* Instant Messaging 
e Tasks & Team Work Tracking 


504.1.2 Early adopters project 3m 


e Collaboration Pilot 1 (tbd) 
e Collaboration Pilot 2 (tbd) 
e Collaboration Pilot 3 (tbd) 


Increase quantity and availability of IM and Apollo training 


SD4.2 В 11т EIMD 
— — — and coaching 


SD4.2.1 Develop Training Strategy 1m 

SD4.2.2 Develop a Train-the-Trainer approach 3m 

SD4.2.3 Expand power-user training 1m 

SD4.2.4 Develop a self-service training/tutorial portal 6m 

Create Culture Change Management strategy In support of IM 

SD4.3 11m EIMD MRAP 2.3 — 
30/11/2016 

SD4.3.1 Develop a Change Management Plan that will help improve our 5m 


"Information Culture and Awareness" 


e Communication plan 
* Training and Coaching 
e Mission Values 


SD4.3.2 Establish the IM Guides / Influencer network 6m 
SD4.4 Increase connectivity and integration capabilities 7m 
SD4.4.1 Apollo Mobility assessment 1m 
SD4.4.2 Apollo business-app integration capability requirements 2m 
SD2.4.3 Integration of Apollo to Enterprise Search Capabilities 4m 
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Agenda 


Value Proposition 

The Changing Information Environment 
The CBSA IM Vision 

IM Principles 

3 Year IM Strategy 

2016/17 Action Plan Highlights 

Risks / Challenges 

Summary 

Annexes 
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Value Proposition 


Information is a Business Resource (like Human Resources and 
Finance). Not managing it is not a viable option: 


e Information can enable us and overwhelm us. There is such a thing 
as “Too much information” 

e Everything we do within the Agency starts with information and 
generates more information 

e The Agency renders decisions every minute using "Information" 


PROTECTION + SERVICE • INTEGRIT^ 
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Desired Outcomes of Information Management Strategy 
* Globally, the information environment has become increasingly complex and challenging to manage. 
e Tools and techniques are evolving but fall short of optimizing Agency Information as a critical resource 


e The IM strategy drives the paradigm shift from traditional IM approaches and solutions to what is and will 
continue to be required moving forward in the public service 


| , Compliance-focused, primarily reactive involvement Proactively involved with business clients (as early as planning stage), 
EIM is a foundational business support | | | : o- a | | 
in business processes and operations. focused on improving information flows and availability of information. 
_ : . . , Relevant, reliable, and efficient services, tools and solutions provided 
EIM Services supports the business in Mandated and difficult enterprise-wide solutions. io business client 
. managing Agency information *Thou shalt comply" mindset . : : v v 
— зеи PY (Business comes first" mindset) . 
Risk-based approaches successfully applied to minimize on-goin 
Management of information is All unstructured information treated as equally i | . Y. d + À 
| : | _ s management of transitory information and focus resources on 
focussed on high value information important making it difficult to focus resources and | | 
| information of business value. 
resources efforts strategically. 


(Focus efforts on high-value resources) 
Agency information is lifecycle 


managed to ensure high value 
information is not lost 


Innovative use of a wide spectrum of solutions to iteratively and 
Reliance on unproven and limited functionality 


progressively develop the Agency's capability to perform information 
proposed by content management system vendor. : | 
lifecycle management. (slowly move yardstick forward) 


Information Management program Sequential records based process with little client | | 
22 Dm : : | ШШ | Incubation, progressive release, early adopters, starting with small 
activities and initiatives are designed input, narrow focus, multi-year deliveries, risk of ШШ 
| changes, building up support and user comfort. 
around CBSA business needs rejection 


information Resources of Business 


: D opread across multiple unstructured repositories, 
Value are identified, mapped and 


| _ Centralized, highly integrated enterprise content management 
| . low-visibility, out-of-context. Low usability of the . 
organized for efficiency and platform, metadata-rich. High business usability of information. 
t information. 
productivity 
PROTECTION • SERVICE + INTEGRITY 
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Vision 


e Тһе Information Management Committee (IMC) approved Principles (April 2016) lay the foundation for 
an IM strategy that supports the creation of an Agency Information ecosystem of managed 
repositories, a connected and networked workforce, and alignment to Government of Canada 
(GC) IM policy and direction. 


CBSA IM Vision 


“Unlock the Value of our CBSA's CBSA's information 
information by ensuring all information is uu a and 
CBSA staff and Managed É sA | eund 
il Responsibly « “= managed Eco- 
stakeholders have seamless Є system 
access to the reliable, 


timely and complete 
information they need to 
perform their duties in a Measure and 


well managed state." improve workforce to 


prodram succeed 
delivery 


Leverage 


Data to  - Connect and 
Empower the 


ECTION « SERVICE + INTEGRIT 
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CBSA IM Principles 


The CBSA IM principles provide the framework to help us understand and organize 
our efforts and develop : 


IM Principles Key Deliverables 


СВА information is Managed 
Responsibly 


СВА information is Created and 
Resides in a managed Eco-system 


Leverage Data to Measure and Improve 
program delivery 


Connect and Empower the workforce to 


succeed 


Create an information accountability framework that 
encourages desirable behavior in the valuation, creation, 
storage, use, archiving and deletion of information. 


Continue Agency adoption of Apollo, increase 
management of email business information and 
decommissioning of network drives in support of Agency 
business and alignment to GC. 


Mature the Agency's capacity for data governance, 
business intelligence, and advanced analytics to drive 
better risk management, enforcement and decisions. 


Action organizational culture change through 
communications, marketing, and workshops to facilitate 
the sharing of information and knowledge as a strategic 

asset for efficient border management. 


PROTECTION + SERVICE - INTEGRIT! 
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2016/17 


2017/18 


2018/19 


3 Year IM Strategy Road Map 


Continue user on-boarding of Apollo in HQ and on-board regions 


Continue to assist users in the management of email information of business value in support of Email 
Transformation Initiative 


IM Services environmental scan and alignment with new GC IM Strategy 
Action all internal CBSA and Office of Comptroller General Audit deliverables 
Initiate Network Drive clean-up and shut down “campaign” 

Transformation of EIM Division — HR Plan and Financial Sustainability 

Begin executing the CBSA Open Government Implementation Plan 

Identify releasable data sets for Open Government and begin release 
Publish CBSA conceptual information architecture V1 

Implement the CBSA Data Analytics Business Case 


Continue standardization of IM functions across the regions 
Identify and map data / information repositories with information architecture that reflects business model 
Modernization of RecordKeeping and information lifecycle management 
° Initial electronic disposition via Apollo. 
Begin release of identified data sets for Open Government 


Revise 3 year IM strategy based on results achieved and GC direction. 
Migration of Apollo to GC Hosted GCDOCS environment 

Increase integration with information systems and technology 
On-going release of approved data sets for Open Government 
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2016/17 Action Plan Highlights 


As part of the overall 2016-2018 Strategic Direction Roadmap, the following activities are proposed for the 
current fiscal year (2016/17 one-year plan): 


e Environmental scan to identify gaps between current IM services and TBS Government of Canada IM 
Strategy (Q3-2016 / Office of Comptroller General (OCG) Audit Deliverable) 

| * Develop new IM Service Model and catalogue of services (Q4-2016 / CBSA Audit Deliverable) 

| Transformation * Propose common IM functions / competencies / job descriptions / classification levels throughout the CBSA 

Activities (01-2017 / OCG and CBSA Audit Deliverable) 


* Develop Human Resources Plan, Training and Development Plan and Investment proposal in support of 
ongoing IM capacity and competency profile (Q3- -2016 / OCG and CBSA Audit Deliverable) 


e Continue business on-boarding and adoption of Apollo — improve performance and stability (Q4-2016) 
* Initiate Shared Drive clean-up and shut down (Q4-2016) 


e Execute the approved CBSA Open Government Implementation Plan (OGIP) (Q4-2016) 
Implement the CBSA Data Analytics Business Case (pending EC approval) (Q4-2016) 


Strategic m I: gg: III 
Activities Develop IM Performance Management Framework and scorecard — seek IMC endorsement (Q3-2016 / CBSA 


and OCG Audit Deliverable) 
Review IM Roles, Responsibilities and Accountabilities within the Agency (Q2-2016 / CCBSA Audit Deliverable) 
pd IM Roles, Responsibilities and Accountabilities communication plan — present to Executive Committee 


Increase IM Awareness activities including communications, workshops, outreach in support of 


organizational culture change. (Q1-201 7) 
Increase quantity and availability of IM and Apollo training and coaching (Q1-201 7) 
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Risks 


Employee 
Awareness 


External 
Service 
Delivery 


Treasury Board 
Secretariat IM 
Strategy 


Funding 


Data vs 
Information 


Description 


Disengagement of workforce in the 
management of information. 


Delivery date of GCDOCS Hosted 
Service not expected before 2018-19 


Potential upcoming changes to TBS 
GC EIM Strategy, Policy and Directives 


Insufficient resources to support EIM 
program and enable transformation 
over multiple years 


Structure databases are subject to 
same information lifecycle 
management policy requirements 


PROT 
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Proposed Mitigation 


Ongoing awareness and communications. 
Specific controls to facilitate information 
management including obligation to save in 
Apollo, read only network drives, no email 
attachments. 


Continue with CBSA hosted solution while 
continuing to align with service provider 
vision/architecture 


Proactively engage and collaborate with central 
agencies through key committees to monitor 
trends and changes 


Prioritize strategic action plan and focus 
resources on key business support activities 


Complete the information and data 
architectures with a focus on Mission Critical 
services and systems 
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e Endorsement of 3 year IM strategy 


* Provide on-going advice and guidance 
as 1 year action is implemented 


* Provide ambassadorship role through 
visible senior management "leading by 
example" and setting of IM expectations 


* Monitor IM Strategy progress quarterly 
at IMC and annually at Executive 
Committee 


- William Pollard 
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CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 
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CBSA - Released under the Access to Information Act. 


ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


ing Principles 


Gu 


CBSA EIM adopts Guiding Principles defined in the Government of Canada Enterprise 


Information Management Strategy, as follows 
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* TBS’ proposed IM Policy Suite Reset (2016) introduces key changes in the Roles and Responsibilities 
for the management of information: 


Designates the Chief Information Officer (CIO/IMSO) as the official responsible for providing leadership, 
coordination, and oversight responsibilities for the management of information in support of the development and 
delivery of Government of Canada policies, programs, and services. 

Proposes a new Directive on Managing Information (4 mandatory procedures and 2 standards) and delineates the 
responsibilities of departmental C/O, senior management and individuals in the management of information. 


* New responsibilities for Deputy Heads and the CIO include (as per Annex B-C of the proposed policy 
suite reset) : 


Establishing practices and procedures for consistent management of information resources in their department 
that align with government-wide direction (Annex B 1.1); 

Ensuring that decisions on the development and delivery of policies, programs, and services, and the evidence 
supporting those decisions, are documented (Annex B 1.2); 

Integrating IM requirements into the development and delivery of policy, program, and services, evaluation and 
reporting (Annex B 1.3); 

Aligning investments in IM tools, solutions and systems with Government of Canada direction (Annex B -.4); 
Approving a departmental IM plan that details the activities to be undertaken for the management of information in 
the department and for meeting government-wide IM objectives (Annex B 1.10). 

Developing and maintaining a departmental IM plan that details activities to be undertaken to manage the 
information of the department and to meet government-wide IM priorities and objectives (Annex C 1.1). 

Identifying information resources of business value held by the department based on an analysis of departmental 
functions and activities (Annex C 1.2). 

Establishing and maintaining designated corporate repositories, classification structures, and metadata to facilitate 
search and retrieval of information resources of business value (Annex C 1.3). 


Performing regular disposition activities for all information resources according to documented processes (Annex 
C 1.4) 
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impetus for Change 


Internal Drivers 


Aging information flows and business processes 

Information is born / created in unmanaged electronic repositories 
Information stockpiling 

Lack of oversight on most of the Agency's information holdings 

Limited ability to facilitate bringing together new ideas (crowdsourcing) and 
engagement of the workforce 

Limited Reach of Information Management support services 

Difficulty implementing efficient Electronic Records Management processes 


External Drivers 


TBS's Directive on Recordkeeping prescribed level of maturity 
TBS's Directive on Open Government 


requirements 


LAC no longer be accepting information of enduring value created in paper format after 
2017 


As of July 2015, LAC no longer stores records that are not of enduring value. Boxes of 
paper are being returned to the originating departments 


* SERVICE = INTEGRITY 
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nternal audit of IM 


CBSA participated in a horizontal internal audit of IM carried out in 2015-2016 by the 
Office of the Comptroller General (OCG). 


The audit has identified that the Agency has governance and some monitoring 
frameworks in place to support IM; however, IM is currently delivered as a number of 
initiatives instead of an Agency-wide program. 


As a result, there is an ongoing risk that IM will not be integrated as a foundational 
business support for the Agency's activities. 


Opportunities exist to enhance roles and responsibilities, accountabilities, procedures, 
and reporting and monitoring practices for IM. 


The audit reported several findings and issued the following recommendations: 


1. Further define and communicate IM responsibilities and accountabilities; 

2. Implement and communicate standard IM tools, guidance and best practices across the 
Agency; 

3. Develop and implement Agency-wide operational and human resource plans for IM; and 

4. Monitor and Report IM on a regular basis. 
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CBSA\‘s information is 
Managed responsibly 


OUTCOMES BENEFITS 


* The Agency's information is treated and managed as a Strategic * Improved Decision Making 


Resource (like Human and Financial Resource) s peceased to лак ês 


e Information Accountabilities, Roles and Responsibilities are 


* Increased health of the Agency's information 
effectively delegated and monitored ae 


ecosystem 


e Agency information in multiple repositories is identified and 


« Strong Management Accountability 
accounted for 


* Increased compliance and efficiency through business process 
improvement 


CURRENT GAPS KEY INITIATIVES 


e National IM Reporting Framework 


Operational 


* Regional IM roles and responsibilities are often not 


acknowledged or defined ° Strengthen IM Roles and Responsibilities 


* Perform Information / Data holdings 


* Paper / electronic information unmanaged and orphaned environment scan 


e Data quality challenge - no identified stewardship roles e Continue to work towards compliance to 


the GC Policy suite 


* Organizational change management plan 
in support of collaboration and information 
sharing 


* Data is siloed and inaccessible to most of Agency 


Compliance 


e Lack of information lifecycle management is a compliance risk 
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СВА information is created and resides 
in a managed Eco-system 


OUTCOMES BENEFITS 


„ Users have access to new value-added features e The agency's Information is richer, easily accessible 
and re-usable 


* Older technologies can be phased out (i.e. network 


drives) * Access permissions and collaboration is facilitated 
• Information is born within a modern enterprise content l * Increased user productivity and efficiency 
management platform (GC Standard) e Information Management tasks can be integrated 
* Information is effectively connected to a business and transparent for users 
process. e Currently unused or under-used information assets 


can be leveraged 
* Organizational knowledge and memory is protected 


CURRENT GAPS KEY INITIATIVES 
Operational 
* Network drives, Outlook, local drives and PSTs e Re-launch Apollo for business onboarding and adoption 
currently largest repositories of unstructured and * Optimize business information flows through enabling 
currently unusable business information resources technology 
e Multiple stand alone and aging systems e Shared Drive clean-up and shut down 


* Capture business information in siloed repositories 
Compliance 


e Modernize the way we do recordkeeping and Lifecycle 


* Information not managed per GC regulation Management 


* No efficient process in place to efficiently purge 
information — increased liability and clutter 


ECTION + SERVICE + INTEGRIT 
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performance 


OUTCOMES 


* Improved program delivery 


e Identifying opportunities for greater efficiency across 
Agency 


e Single version of the truth 
e Increased opportunity for organizational learning 


CURRENT GAPS 


Operational 


* Challenge in accessing data required to perform time 
sensitive front-line operations. 

* Poor data quality affects the Agency's ability to make 
the right decisions. 

* Limited workforce skillsets. 

e Technology challenges. 


Compliance 


* Requirement to continuously measure and improve 
performance. 


* Open Government Directive requires proactive release 


of information and data to the public. 


Leverage Data to Measure and Improve 


BENEFITS 


Improved situational awareness and decision- 
making 


Increased competitiveness and efficiency 
Reduced Agency risk posture 
Opportunities for cost avoidance and savings 


KEY INITIATIVES 


Data acquisition involving the identification 
and prioritization of CBSA, GC, and third- 
party data 


Establishing a task force dedicated to 
privacy and security 


Applying best practices from B5 partners 


Workforce skill development and 
recruitment 


Execute the approved CBSA Open 
Government Implementation Plan (OGIP) 
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OUTCOMES BENEFITS 
* The workforce operates within collaborative e Increased productivity and facilitated operations 
networks * A high performance information ecosystem 


* The Agency's IM culture and behavior is * Increased idea generation, creativity and 


predictable and effective 


* [he Agency's human resources are empowered 
with accessible and usable information resources 


CURRENT GAPS 


Operational 
e Information currently in siloes 


e Outdated business processes inhibits efficient 
business collaboration 


Compliance 
* |Mis viewed as an EIMD responsibility 


* Open Government and Open by Default not part 


of culture. 


knowledge sharing 


KEY INITIATIVES 


Identify and promote collaborative networking 
opportunities using Apollo capabilities 


Increase quantity and availability of IM and Apollo 
training and coaching 


Create Culture Change Management strategy 
Increase connectivity and integration capabilities 
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CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 
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е 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


m 2 


Traveller Str 
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CBSA - Released under the Access to Information Act. 
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CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Executive Summary 


Identifying risk, and doing so early, is a key component of the CBSA’s mandate. One key method of 
tisk assessment is through the Agency’s Commercial and Traveller Targeting Programs. Targeting is 
currently supported by automated, expert-based systems in both the commercial and traveller streams. 


Data mining in particular, uses machine-learning algorithms, with limited human intervention, to find 
faint patterns or relationships between data elements, in large, complex data sets, that are of business 
interest. At a high level, the use of data mining techniques 


The Enforcement and Intelligence Directorate of the Programs Branch has worked closely with the 
Science and Engineering Directorate (S&E Lab) in ISTB to pilot predictive analytics at the CBSA, for 
pre-arrival risk assessment within the air traveller stream. The full scope of work for this pilot was 
completed within 10 months; 7 months were dedicated to preparing the data for predictive analytics, and 


3 months were dedicated to advanced modeling. 


Several machine-learning models were created and tested, with the best one giving very promising 
results. By making use of a relatively small amount (1.е., only API and PNR data) of the information | 
available to targeters in their decision-making process, it was possible to correctly predict up to of | 


the known illicit cases. These results were achieved 
The results achieved can thus be seen as a lower bar as to what is possible. 


The S&E Lab will proceed to phase two of this pilot in an attempt to address some of the more difficult 
aspects of this work and to improve the already promising results. Although continuing this work will 
require a concerted effort from many different parties, the promising results of this pilot suggest that this 
yore will be кы worth the olor This блок has pr oved the value of this pendiam shitt, and al. 


s dines of business 
ad so these initial efforts can also be : seen 


as a powerful opportunity to educ ate the Agency at large, as to the power and value of such work. 
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Identifying risk and doing so early is a key component of the CBSA’s mandate. One key method of risk 
assessment is through the Agency’s Commercial and Traveller Targeting Programs. These programs 
rely on. oe 


tr mae sti гаша. 


К mE by using predictive analytics 
techniques, the Agency can sift through large data uu in an automated 
fashion, С 


Predictive analytics includes advanced mathematical and statistical techniques, which look at historical 
data to make predictions about future events, The goal of such work is to use machine-learning 
algorithms, with limited human intervention, to find faint patterns or relationships between data 
elements, in large, complex data sets, that are of business interest. Because the analysis does not start 
with a specific hypothesis , the al gorithms may 
unbiasedly identify trends that would other wise go undetected. At a high level, the use of data mining 
techniques 


РЕ ъс so ~ ә w аа. 


Given the large volume of travellers and conveyances coming to Canada, along with the ever increasing 
collection of data, and rapidly developing technologies, the Canada Border Services Agency (CBSA) 
must begin to leverage predictive analytics to assist in the automation of risk assessment. 


ween en 201 id and 2013, in the 


The Enforcement and Intelligence Directorate of the Programs Branch has worked closely with the 
Science and Engineering Directorate (S&E Lab) in ISTB to pilot predictive analytics at the CBSA, for 
pre-arrival risk assessment in the air traveller stream. The full scope of work for this pilot was completed 
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within 10 months; 7 months were dedicated to preparing the data for predictive analytics, and 3 months 
were dedicated to advanced modeling. This report describes the methodology used by the AA section, 
the results obtained through machine learning techniques, and the applicability of machine learning at 
the CBSA. | 


Methodology 


Data Extract: Passenger Information System (PAXIS) and Integrated Customs 
Enforcement System (ICES) 


In order to facilitate risk assessment in the traveller stream, 


(the tools used to access and analyze the data). 


In order to pilot a predictive analytics i in the air traveller stream, the S&E Lab required access to the 
same data described in the previous paragraph. The team 


However, due 
to the legal and technical requirements of the Protection of Passenger Information Regulations (PPIR) 
and the commitments made to the EU, the data extract request was modified at the request of the data 
owners (Programs Br anch) to exclude the transfer of As a result, the Enterprise Data 
Warehouse Division in ISTB extracted from the production environment onto the 
Enterprise Data Warel nouse (EDW), the week of June 15, 2015, and access to this data was given to the 


S&E Lab. 


Data аира, Matching Records from ICES to PAXIS 


The development ofa pr йе model depends heavily on matching the 
this is because data mining requires information about a passage | 


.. This means thata 


a ст as non-r T0 
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In an effort to link the ICES data to its corresponding API/PNR data : the 


following set of rules were applied by the ED W Division. The rules were applied to data from three 
tables in PAXTS and one table in ICES. 


. If all eight rules above, matched an ICES record to a PAXIS record, then this record would have 
qualified as a match; otherwise no match would have been made. Note that of the seizures 
recorded in ICES for the period of December 1, 2013 to May 31, 2015, matches were made. 


Given that by this point, much work had already been done, the S&E Lab did not ask the EDW section 
to implement any relaxed criteria, À maximum of. extra matches would not have provided enough of 
an improvement compared to the amount of work that would have been required to implement such 
changes. 


The figure below shows, very simply, that matching rules were created and applied to link up records in 
ICES with their corresponding API/PNR data. 
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Matching Criteria 


| API Table | | PNR Table] — --------------» 


API Table] | PNR Table] mx | ICES Table 


| API Table Ji | PNR Table — aie aaa iat 


Figure 1. Matching process between APT, PNR and ICES datasets. 


Dataset to Unique Passages 


Data Reduction: Redu 
Final Data Preparation Step 


The previous step was required in order to identify all of the data elements from the PAXIS side that 
corresponded to a particular seizure on the ICES side. All travellers recorded in ICES and matched to a 
record in PAXIS based on the rules described in the previous section, have several corresponding 
primary keys These primary keys, in theory, should allow 
for the ICES and API/PNR tables to be stitched together, to end up with a lar ge dataset such as the one 
that is pictorially oversimplified below. 


API Elements PNR ICES 


> Resultant or 
Non-Resulant 


Figure 2. The different datasets linked together ù into a а full dataset. 
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However, the previous process is complicated by the following relationships: 


As a result, logic had to be formulated in order to reformat the data, so as to end up with one row for 
each unique passage into Canada. Two IBM Modeler streams were independently created so as to 
confirm the logic of one stream with that of the other, and vice versa. This was done as a way to validate 
the logic prior to model building, and as a way to build in error and quality checks. Both streams follow 
very similar (almost identical) logic and rules. Once the data preparation was completed, the model- 
ready dataset contained: 


e Approximately 37 million unique passages into Canada (which falls in the range that is reported 
by the CBSA, in the Consolidated Management Reporting System) 

e Approximately (data from the API/PNR and ICES tables) 

ә Roughly of the above 37 million passages corresponded to travellers that were caught 
with contraband 


The data preparation steps described above were very challenging and time consuming activities (~ four 
of the six months allotted for the pilot); EN 

Future iterations of this pilot would require the above data 
preparation logic to be repeated, but would be more streamlined. | 


Graphical Exploration of the Model-Ready Dalaset 
At this point, some descriptive statistics will give some context to the raw data that was used to create 
predictive models. Below, some basic statistics are reported for the full ICES results from the 18-month 
period of the data for this pilot, as well as for the subset that had matched to API/PNR data. Table 1, 
below, shows the top ten types of resultants within the dataset; 
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Figure 4 below, highlights that the contraband caught, follows 
This figure also shows that the number of seizures made per month, follow a 
distribution, 
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z Number of Resultants 


P-————————————— ————————————— Mr 


Table 2 below shows that (in the model-ready dataset) were reported (in 
ICES) as being referred by a BSO. This trend is consistent when all seizures are considered (for 


the 18-month period), as seen in Table 3. Digging even deeper still, of all resultants in the same 
period were associated with in ICES, | 
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Table 2. Contraband seizures in the model-ready 
dataset, by referral type. —— uu 
[Туре of Referral -Percentage Count 
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Variable Creation 


Next, the model-ready dataset described above, with the raw data variables ( i.e., variables in their 
raw form pulled directly from API/PNR, and ICES tables), was used to create new elements for use in 
the model building phase. 


Some variables in the dataset, in their raw state, are unusable for modeling. À prime example of such a — 
variable would be any On their own, are not usable for modeling purposes, because they 
don’t say much in and of themselves. However, in comparison with other in the data, they could be 
quite valuable. 


The S&E Lab focused their efforts on the creation of data elements that could lead to interesting patterns 
for model creation. An opportunity exists for different areas within the CBSA, to get involved here, 
particularly those responsible for creating the scenarios for Scenario Based Targeting (SBT), With their 
extensive knowledge and experience, they may be able to suggest potentially useful information and 
thus help to create potentially useful variables as inputs to the modeling step, in future iterations. 


Modeling — Training and Testing 


At this point, the dataset was ready to be modelled. The first step in the model building phase requires 
splitting the dataset up into two sets: one for “training” and one for “testing”. A training set is a subset of 
the full data, which is used to create a model. A testing set, is the other subset of the data (what is left 
over), which is used to test the model that was created in the training set. The reason the data is split in 
this fashion, is because it is important to test the model using new data (i.e., data that the model has not 
“seen”, or which has not been used to create the model). 


models, and were used to test the models that were built. In the training set, of the 
records, there were roughly resultants, and in the testing set, ofthe records, there were 
roughly resultants. 
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Several different machine-learning techniques were used to build models with the training dataset; these 
include decision trees, decision lists, logistic regression and neural networks. These models were all 
generated without human intervention and their outputs are solely data driven; the data drives the 
patterns that are found by the algorithm. Due to the time constraints in this pilot, most of the efforts were 
spent on outputting a model that would be interpretable and that would showcase the potential for 
straightforward integration into current targeting systems (SBT), As a result, many different decision 
trees were built, One in particular gave the best results, in comparison to all models built. 

A decision or classification tree is a predictive model that acts as a decision tool and is straightforward 
to understand and follow. In short, a decision tree uses the observations about a particular item, and 
relates it to an outcome, In this pilot for example, a decision tree maps several observations about a 
particular passage (1.e., API/PNR data from a particular passage) and relates it to a risk category (i.e., 
low risk/high risk, or non-resultant/resultant). Along with the prediction of risk level, a decision tree 
outputs & confidence measure in the predictions; these confidence values can subsequently be used to 
determine thresholds that would highlight which passages and passengers to focus on. 


Depicted below is an excerpt from the best model that was generated, The full tree was too lar ge to be 
presented here. 


Figure 4. An excerpt of the best model (a decision tree) built and tested. 


An example of how this part of the tree can be read, is as follows: 


& 
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Correctly 


| Classified: 


Figure 5. Assessment of the best model that was created, 


Put into matrix form, the above results can be summarized as follows: 


14 - >... 
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Table 4, Confusion matrix showcasing the of the best model created. 


D Predicted Predicted 
Non-Resultant Resultant 


Actual Non-Resultant 


Actual Resultant 


0 
© 
= 
фей 
c 
«t 


The results above show that the best model that was built, can correctly predict of the non- 
resultants and of the resultants. That is, 


This has 
significant implications for the Agency. 


A perfect model would predict 100% of the non-resultants as non-resultants, and 100% of the resultants 
as resultants. So, in the above case, the off-diagonals (in red) are the errors; of the resultants were 
incorrectly predicted as non-resultants and of the non-resultants were incorrectly predicted as ٠ 
resultants. If this model were implemented solely on its own, without additional intelligence or BSO | 
intervention, For example, implementation of this model, | 
alone, would result in roughly | .. Тһе obvious 

question that follows is, "How big is More importanly, “Would pose 

a problem operationally?” If it is considered too large of a number, there are ways to reduce it (which 

will be discussed next). However, relying only on the decisions of a model would not be adviseable at 

this stage. | | 


It is also important to note that these results do not imply that all incorrectly classified cases of 
contraband smuggling would have gotten away had this model been used in the CBSA’s production 
environment. One has to remember that these cases were caught using the combined 
strength of the CBSA’s interdiction efforts | Hu 

That said, what the above results are truly showing is that, using this 
initial model, in only of cases was the risk of contraband smuggling prior to the travellers arrival 
in Canada not identified. 


Model Based on a Threshold of Confidence 


Given the results in the previous section, the goal of this next step was to create a more feasible and 
realistic model solution 
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To this end, the S&E Lab decided to employ a fairly simple technique: every ‘resultant prediction with 
a corresponding confidence value equal to would remain a ‘resultant’ prediction; all 
other ‘resultant’ predictions would at this point be re-categorized into а ‘non-resultant’ prediction. 


The table below shows that this process reduced the false positive errors (from downto , 
however, in doing so, the false negative errors increased (from The positive point to 
highlight is that the thresholded model, if implemented on its own, would now result in roughly _ 

E |. . . . instead of More importantly however, is the ability of 
this model to still pick out of the resultants, using only two sources of data, and doing so pre- 


arrival. 


Table 5. Confusion matrix showcaseing the results of the best model, thresholded (based on 


Predictions 


il | Predicted Predicted 
Non-Resuitant Resultant 


Actual Non-Resultant 


The metrics used in the previous section to assess the performance of the statistical model are 
informative, but do not easily highlight how the model could impact the CBSA’s business processes. As 


mentioned, 
The problem with this line of 


1. Thresholding requires weighing the cost and benefits of relying only on the best possible “raky” 
predictions (ie. there could be many accurate predictions occurring below the selected 
threshold), 

2. The intention of this pilot project is not to say that that there would be | 

That said, a larger amount of predicted resultants might be acceptable, given - 
that the predictions would only serve to populate a worklist. 


16 
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With these points in mind, it could be argued that the resulting from the 


was thus impossible for the purposes of this pilot. — 
The following diagram attempts to highlight the difficulties in comparing the work presented in this 


report, against the CBSA’s current targeting process, The figure below points out that the common 
evaluation metrics, 


m Е the figure below should highlight the fact that these two levels of 
evaluation are quite different. | 


Figure 6. Comparison of current targeting process against the predictive analytics pilot 
process, 


The most appropriate comparison between the CBSA’s current process and this nilot would Inok at the 
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BEEN Due to this fact and in attempt to ensure that proper 
comparisons were made to fairly evaluate this pilot project, only self-contained statistical measures were 
relied upon. The following section will present another such metric that will point to the efficacy of the 
methods described. 


However, : 
comparison to random does provide an effective and self-contained way of assessing tae репоппапсе of 
the models. 


The current targeting process and the process generated in this pilot, serve as different levels of 
screening, which in turn filter through the < ata received to identify records of interest. 
Without any levels of screening, the only option left to identify records of interest would be a random 
selection process; this can be considered a baseline from which to make a fair comparison. Clearly, if 
any screening process, be it traditional targeting or statistical modelling, performed worse than random, 
there would be no use in relying on the decision-making ability of the system. That said, in using a 
random process as an evaluation metric, the ideal result is to find improvement, or “ШЇ” from the 
random baseline. 

In this pilot, a random baseli 


of approximately: . records, close to of which were resultant for contraband. If a record 
were picked at random from the test population, there would be a likelihood of that record being 
a resultant case. See below for the exact calculation. 
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1. Choosing at random within the test set: 
Resultants in Test 
Passages іп Test — 


wee 


2. Using the model: 
Correctly predicted resultants 


may 


Total predicted resultants 
better than random) 


3. Using the model with high confidence resultants: 
Correctly predicted resultants 


Total predicted resultants 
better than random) 


Similarly, once the test data is run through the statistical model, records predicted 
resultant, This means that of all records predicted resultant by the statistical 
model, there is a of a given record being resultant. This is better than 


Finally, if the test data is run through the thresholded statistical model, out of the 


predicted resultant, were truly resultant, This means that of all records predicted resultant by the 
thresholded model, there is a | of a given record being resultant. This is 
better than the Jerformance described above. 

x Р" but it 
does provide a baseline. With the models performing better than ` tis clear 


that there is potential benefit to employing these sorts of data mining techniques, Moreover, when paired 
with the fact that many details have been identfied that could greatly improve this preliminary work, the 
compar ison made in this section could be seen as a strong reason to continue this analysis, as discussed 
in the next section. 


Conclusions and Future Work 


The goal of this pilot was to investigate the efficacy of using machine-learning techniques on pre-arrival 
data in order to identify cases of probable contraband smuggling. 


it was indeed possible to correctly predict up to of the known illicit cases. 
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Moreover, it is worth restating that these results were achieved in the face of certain obstacles that most 
certainly made this work much more difficult. 


The S&E Lab proposes that this work proceed with a follow-up round of analysis in attempt to address 
some of the more difficult aspects of this work, and to attempt to improve the already promising results, 
An additional benefit to another round of analysis is that it will provide the opportunity to make a more 
concerted effort in terms of gathering statistics | 


Perhaps the main point of improvement for the next phase of this work has to be centred on the 


For example, are collected by the CBSA at the border through IPIL. Each traveller entering 
Canada has his/her passport scanned, generating data regarding the individual in question, which is then 
saved in CBSA databases, 


his information 
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In order to advance this work with a second round of analysis that includes the improvements previously 
mentioned, the S&E Lab will require continued assistance from various areas of the Agency. Assistance 
will be needed from (but not limited to): 


Operations Branch: Work with NTC. subject.matter experts for variable creation and perhaps 
APUPNR data preparation. — 

Programs Branch: Support required for the Round 2 data extract, including extract of new 
fields. | 

ISTB: Support from EDW for the Round 2 matching process, and possibly flattening of the data. 
Data Analytics Work Group: Support and direction in terms of socializing the concepts and 
value of this type of work, 


The work described in this report can truly be seen as a lower bar as to what is possible. That said, 
although continuing this work will require a concerted effort from many different parties, the promising 
results of this pilot suggest that this work will be well worth the effort. This study has proved the value 
of this paradigm shift, and that devoting a focused effort to this type of work could lead to enormous 
value for the Agency. Moreover, these techniques are applicable to many other of the CBSA's lines of 


business | 


and so 
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i Currently, prior to the 
arrival of goods to the country, the only description of the physical goods that is received is provided in 
a free-form text field. This study uses commercial off the shelf products that the Agency has made a 
major investment in, to be able to extract standard commodity descriptions from the free-form text in 
order to be able to use it in an automated fashion. The results that are presented are compared with 
previous work performed by the Advanced Analytics Section, and suggest that actionable information 
can indeed be extracted from this textual information, 


Purpose 


In order to both secure the country's borders and facilitate legitimate trade, many attempts are being 
made to automate historically manual processes overseen by the Agency. One of the most critical 
processes being automated by the CBSA is the pre-arrival risk assessment of commercial cargo bound 
for Canada. The Agency has been working towards automation of the risk assessment process since it's 
inception in 2001, which has resulted in the creation of TITAN, an automated system aimed at aiding 
the human targeter's search through the waybills of incoming freight conveyances In both the Marine 
and Air modes. 


TITAN (to be renamed ‘PHOENIX’ by the completion of e-Manifest) has been continually improved 


upon since its initial implementation in 2004, and upon its completion, the eManisfest project will 
result in TITAN being extended to both Highway and rail Modes. Moreover, 
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An important point to note within the context of this report is that many risk rules, such as the one 
described in the preceding paragraph, are relatively trivial to implement. 

the 
creation/implementation of these rules really only requires the Agency experts to maintain a list of the 
ISO Codes for being flagged by the rule in question. Because this information is so easy to 
input, the tends to be transmitted very consistently and error-free by the trade 
community. Paired with the fact that comparing incoming ISO Codes with those being flagged by the 
CBSA experts is an operation that is trivial to implement, it is safe to say that these sorts of data 
elements form a solid basis for risk rule creation. 


However, with such a variety of risks under the Agency's purview, not all of the risk rules created for 
use within the automated risk assessment process run on clean, codified data. 


in comparison to the more straight forward rules based on rules based on text 
present many problems in terms of automation; 


? http: / /www.iso.org/is 
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Many of these questions have been well documented and analyzed, With the exception of a previous 
report’ generated by the Science & Engineering Directorate’s Advanced Analytics Section, much of the 
work done in this area has centered on identifying the issues, as opposed to posing solutions to them. 
The following sections, however, will outline a potential solution using the technology readily available 
within the CBSA. Firstly the methodology will be outlined at a high level, followed by an analysis, and 
presentation of the results. 


An Important aspect of this study was to make use of the text analytics functionality within the IBM 
SPSS Modeler data mining suite. in recent years, the Agency has made a significant Investment in this 
technology, and made an additional purchase of a component specifically aimed at making use of 
textual information in an automated fashion. In the future, the CBSA may be able to make use of IBM 
suite, which would allow work done in Modeler to be published and used directly in the Agency's 
production systems. Viewed in this context, the results described herein may represent the horizon of 


$ 


the Agency's risk assessment capabilities. 


With regards to textual data, the aforementioned software is aimed at allowing for the creation of 
statistical models that could highlight patterns and trends within the text, which could then be used for 
automated tasks like classification (i.e., categorizing the text into different categories), or sentiment 
analysis (1.е., attempting to extract a sense of what the text is saying about a given topic). In order to 
help with these tasks, the software provides various built-in subject specific dictionaries, and text 
mining algorithms that can be used in conjunction with the data manipulation operations and data 


To begin with, one must understand the high-level processes that get used with the IBM SPSS 
Modeler’s text mining functionality. The first thing to understand is the software's use of dictionaries; 
these are predefined inputs to the text mining process, which essentially define the words recognized 
hy the text mining software (l.e, any word not appearing in the chosen dictionary will be ignored in 
the subsequent processing). That being said, the term 'dictionary' seems a little less appropriate than 
using the term ‘vocabulary’ for the chosen lexicon. Nevertheless, the software comes with several 
preinstalled dictionaries, many of which are subject specific (banking, marketing, etc.), and not 
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necessarily applicable for the CBSA’s purposes. For this reason, this study makes use of the standard 
English dictionary provided with the software. 


The software does give the user the ability to add any domain specific language to the lexicon that may 
be lacking. However, for reasons that will be described in the discussion after the presentation of the 
results, doing so for this particular piece of work would have most likely resulted in a waste of effort in 
that the number of terms needed to be extracted already overwhelms the software as is. 


Despite these potential set backs, what will be shown is that there is potential for optimism when 
dealing with these textual cargo descriptions. The results given will show that there is indeed potential 
to extract enough information from the text in order to give a more standard description of the 
commodity the text is attempting to describe. In pairing this with previous work? performed by the 
Advanced Analytics Section, there is reason to view this particular problem as solvable with the proper 
technological framework in place. 


To begin, a certain amount of data pre-processing was required. In attempt to attain some form of 
standardization amongst the textual descriptions, two broad data cleansing steps were undertaken, 
Firstly, all numerical characters were stripped from the descriptions, simply because, if provided 
correctly, the commodity should be described in the text by words. Indeed, numbers may appear for 
the purposes of relaying the quantity of the goods being described, but the commodity Itself should be 
present as text string somewhere in the description. 


The next pre-processing step was to remove all punctuation characters from the text. This step might 
seem somewhat dubious, in that IBM SPSS Modeler does provide the capability for some level of 
Natural Language Processing, which would make use of punctuation, in order to tag the parts of speech 
within the descriptions (tagging the nouns, adjectives, names, etc.), Due to past experience in using a 
Natural Language Processing package on similar descriptions, the removal of punctuation was deemed 
a justifiable step. The problem that these descriptions are rarely properly formed sentences and are 
often merely just lists of nouns, making any effort in performing Natural Language Processing largely a 
waste of time and computation. 


Once these basic data cleansing operations were performed, the data was then fed through the IBM 
Text Mining module. As mentioned above, the module makes use of the selected dictionary (i.e., the 
basic English dictionary in this case) to weed out words (from the text) that don't appear in the 
vocabulary, and to perform several more advanced processing steps (identifying synonyms, finding 
multi-word concepts, etc.). 


An important point to note is that the Text Mining functionality within the IBM suite gives two ways of 


generating a text mining model for use within a data mining stream; the first is aimed at novice users 
and allows them to generate a model directly with little user-interaction, while the second method is 
interactive, and requires the user's input to generate the model. A key point In this study, with regards 
to these two options, is that the more simplistic option allows for the extraction of only 1000 concepts, 
and the more complex, interactive option extracts up to 10,000 concepts. In both cases, these 
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‘concepts’ are typically single words, or perhaps two-word groups that occur commonly together, such 
as "car parts", or “apple juice", etc. In order to foreshadow problems to be discussed later on, 
consider the fact that there are one million possible standardized codes for commodities in the United 
Nations Harmonized System at the six-digit level alone. 


That aside, once the concepts were extracted, the resulting model was then used to turn the data into 
a so called 'Bag of Concepts'. This means a new variable was created for each concept, which took on 
the value of 1 or 0 depending on whether or not, the given concept appeared in each piece of text. It is 
critical to note that this process dramatically increases the size of the data, and as will be shown, can 
be burdensome on memory requirements. Prior to creating the 'Bag of Concepts', the data set had a 
single text-based data element, whereas at this point in the process, the data set would potentially 
have 10,000 different binary variables. 


That being said, once the ‘Bag of Concepts’ is generated, the analysis and data manipulation 
techniques included in the base module of IBM SPSS Modeler can be used to extract patterns and 
trends to use for predictive purposes. This means that standard data mining algorithms can be used to 
produce predictive models like decision trees and neural networks. A particularly useful type of 
analysis for high dimensional, binary data is what is known as ‘Market Basket Analysis', which can be 
done within IBIM data mining suite using the Apriori algorithm. This particular algorithm was discussed 
in a data mining workshop session? put on by the Advanced Analytics team, and so in what follows, 
familiarity with this concept, is assumed, but at a very high level. The relative rarity/commonality of 
the different concepts in the data (which is used to train the model) is used to create association rules 
that have a guaranteed predefined confidence and support level. That is, 


If A->B is a rule generated by the algorithm: 


1. The confidence of the rule will be the number of descriptions in which А & B appear divided by 
the number of descriptions in which A appears. This measures the strength of the rule, 

2. The support of the rule is the number of times A & B appear together in a description divided 
by the number of descriptions. This measures the rarity/commonality of the rule. 


Note that in many applications, rare rules are often seen as non-useful, and so the threshold for the 
minimum support of any rule is set relatively high in order to ensure that the conclusions drawn from 
the rules occur relatively frequently in the training data, In this context, however, rare rules are 
potentially useful. Keep in mind that the goal in this study is to take any description, regardless of 
wording, and extract a standard form for the commodity being described. That being said, if certain 
words are used, even infrequently, to describe a certain product, it could be beneficial in being able to 
account for the immense variability in the ways that any product can be described. 


With this in mind, it is also useful to note the modeling software allows the user to restrict the 
conclusion of the rules generated by the Apriori algorithm (Le. the right-hand side of the rule, or B in 
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the case of A->B). That being said, if a standard way to describe commodities can be identified, the 
software can then be used te create rules of the following form 


‘Concept 1’ & ‘Concept 2’&...& ‘Concept N’ -> ‘Standard Definition for Commodity Y’ 


That is, by using the concepts extracted from the textual descriptions, it may be possible to infer a 
standard definition for what the text is trying to describe, This would eliminate the need of any 
troublesome, fuzzy matching in the automated risk assessment processes; that is, the Agency could 
then compare standard text to standard text. 


Fortunately for the purposes of this study, the UN's Harmonized System does give standardized 
definitions to any commodity, and on the Release documentation collected the CBSA collects both a 
free-formed text description, and a standardized definition in the form of a Harmonized System Code 
(HS Code). This means that this data can be used to generate a rule set of the form described above. 
The following sections will describe the results of this undertaking, and attempts to interpret them in 
the light of previous work. They will also highlight the difficulties of this process, and give reason to 
believe that they may not be insurmountable. 


indeed, issues with this approach arose almost immediately, Recall that rare rules are potentially 
valuable in this study, which means that the support (and even confidence) thresholds can, and 


= 


perhaps should, be set low in order to cast as wide a net as possible. initially, however, this would 
result in massive rule sets that would be comprised of some 10,000 to 20,000 rules. In and of itself, a 
rule set this size is not an issue. In fact, given the myriad of possible ways to describe a single product, 
it might even be expected. 


Indeed, this is exactly what happened in this experiment. The data was split into two groupings, one 
from 2012 and one from 2013, and then 200,000 lines were selected randomly for each set. This data 
was pre-processed as previously described above, and Apriori models, described above, were trained 
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on the data from 2012. The resulting rule set was used on the data from 2013 in order to test it's the 


ability to generate the correct HS Code from a free-form text field. 


initially the generated rules were run against the 2013 data, and only one prediction was generated 
per description. Recall, there is nothing stopping multiple rules from hitting on a single description, 50, 
to generate a single prediction, one needs only to take the prediction given by the rule with the highest 


That being said, with only one prediction being generated, 


in examining the resulting predictions, it was noted that a significant 
number of cases had no rules fire against them, and thus no prediction was generated for such cases. If 
such cases were excluded, the accuracy of those left over That is to say, for those 
cases for which the resulting model was able to generate a prediction, the model predicted 
correctly with only a single prediction. 


Now recall, for no rule to have fired on a particular case, it would mean that either the parameters for 
the model building were set too high (i.e., rules involving the concepts present in the given description 
did not meet the minimum support/confidence criteria), or the concepts present in the given 
description were not extracted when the text mining model was built. While it is possible that 
concepts involved were so rare that they did not appear in the 2012 training data, the more likely 
explanation is that the 


Now, to help improve the results, and in line with the previous Naive Bayes work, other results were 
generated by outputting more than one prediction per case. As in the previous study, it can be argued 
that doing this is still sufficient for risk assessment purposes, because in effect the model would be 
saying 'out of the huge number of possible commodities, | have narrowed it down a small number of 
possibilities, and one of them is correct with X96 confidence’. The following table summarizes the 
results of generating up to three predictions. 


A Sas dass Said se sen) 
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What this means is that with only two predictions being generated, it is possible to correctly predict 


By adding one more prediction, these results are improved another 

respectively. These results are on par with previous work, and most likely better for the case of 
generating a single prediction. This fact may be further proof of the efficacy of more complex concept 
extraction techniques, because although the previous work had no memory limitations, it perhaps 
suffers by having a very simplistic concept extraction process. Nevertheless, when taken together with 
previous results, this analysis does seem to confirm that it is possible to extract actionable information 
from this free-formed text that has caused such problems for the Agency’s automated risk assessment 
processes. 


Although it may not be obvious at first glance, this work can be viewed as quite positive. Moreover, 
this study lends credence to earlier work done by the Advanced Analytics Section. What was shown 
herein is that, although this initial attempt at using the IBM SPSS modeler software to process these 
troublesome text descriptions may not have been exact, it is possible to exploit the COTS products 
already purchased by the CBSA to dramatically prune the HS hierarchy into a small list of choices for a 
significant portion of incoming shipments. 


The thing to remember here is that the limiting factor to this work and Its results 
not the techniques themselves. There is reason to think that results would drastically 
improve if a larger number of concepts could be extracted. In fact, in previous work, the Advanced 


Analytics Section was able to use the Naive Bayes algorithm to great effect in trying to predict the six- _ 


` digit HS Code from text’, 


Previous work also took the equivalent of one-word concepts in the IBM context, and so the work 
described in this report could even be seen as proving the benefit of being able to extract more 
complicated multi-word concepts, which was in fact a hypothesized improvement to the previous 
Naive Bayes work. The point being, that if a bigger dictionary of multi-word concepts could be 
generated, it is possible that the correct commodity could be extracted from the text, accurately, with 
only the ideal of one prediction made. | m o е MTS 


The one advantage the earlier Naive Bayes work had over the study being described herein was that it 
did not suffer from That being said, its allowable 
vocabulary was massive (i.e., a whole English dictionary with domain specific words added in), and the 
resulting model was able to accommodate millions of variations in the text. 
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To: Phil Lightfoot, Sofia Auer 
From: Darren Coughtrey 


Subject: Using Textual Data in an automated way in the CBSA 
Reference: DC02112015 


Introduction 


Over the past several years, the Science and Engineering Directorate’s Advanced 
Analytics team has amassed a large number of results directed at — 


These various projects have highlighted several overarching 
points that will be tied together in this memorandum. To begin with the reader must be 
aware of the problem that the AA team’s work was aimed at addressing. 


It is a well known fact that all commercial shipments bound for Canadian soil through 
Marine and Air travel 


Many of these risk rules are straightforward because of the nature of the incoming data. 


That being said the process of 
matching incoming data to the maintained list is a simplistic exact match on the 
codified elements. 
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There are, however, different rules that add new layers of complexity for the Agency's 
automated systems due the fact that the data format does not as easily handled 


The prime example of this type of rule and the focus of much of the AA team's work is 
the data element giving the description of the commodity being shipped to Canadian 
soil. Unlike codified elements described above, this particular 
data element comes in the form of a free-form text field with essentially no 
standardization. The trade chain partners are basically free to enter into this field 
whatever information they see fit, and unfortunately for the CBSA, they do. ' 


Things like contact information, internal company coding, and short 


forms that verge on gibberish appear in the data, and it falls to the CBSA to sort this out 
in order to be able to make a risk determination. 


The unfortunate 


thing, however, is that fuzzy matching on text is an extremely difficult task. It can be 


done in fairly naive ways that aim to account for simple spelling mistakes (e.g., omitted 
or swapped letters), or it can be done with fairly sophisticated techniques that take into 
account context, structure, and grammatical nature of the words in the text. 


Moreover, the difficulties with fuzzy text matching are obviously exacerbated by the 
aforementioned data quality issues. In a nutshell the problem is that with the myriad 
ways one can legitimately describe any given commodity, and knowing that the text the 
. Agency receives is of poor quality and often contains superfluous information; what 
words are the CBSA's risk assessment experts to put on their tables of risky 
commodities? | 
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The following 
sections will briefly outline the various pieces of work conducted in this regard, and 
will point to the associated report for the interested reader. 


Risk Rule Performance 


А NM . This was done because 
the Release sent by the importers themselves includes the full ten-digit HS Code, and 
because the importers face steep penalties for non-declaration or misdeclaration, this 
data could serve as a baseline for the analysis of text-based rules. That is, under the 
seemingly reasonable assumption that the received HS Codes are by and large correct, 
one can translate the risk rule tables from text to HS Codes, and then calculate how 
many shipments should have caused a particular rule to fire. 


42011 


| Fuaxy Mat ching ыл i kad HS Cade Matching S, | 


DOCU ELEC Ie ET PETER EEE VOS ENTER SES 


Typically as well, it was found that the text-based rules fired far more often 
than risky commodities were declared on the Release documentation. 
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The reader interested in such results should request the following reports from the 
Science & Engineering Directorate: 


e Division Report 2013 - 01(TR): Deliverable #1 - Analysis of risk rule effectiveness 
based on HS Code 

e Division Report 2014-15(TR): Analysis of risk rule effectiveness based on HS 
Code 


Using Other Standard Codes 


In certain cases, the CBSA is provided a nicely codified value for the commodity being 
shipped to the country prior to arrival. This is mandated when a commodity that is to 
be transported to Canada is listed by the United Nations to be hazardous, and in such 
cases the trade chain partners must submit a properly classified UN Hazardous Goods 
Code. This allowed the Advanced Analytics team to compare the efficacy of the text- 
based fuzzy matching by using the UN Code instead of the HS Code provided on the 
Release documentation, and indeed the results were fairly consistent with the results 
described in the previous section. 


What was found was that there were _ | fewer codified rule hits, lending 
credence to the conclusion that | | | Due to 
a technical detail in the way the Hazardous Goods rules are implemented it was 
difficult to ascertain how many of the shipments listing a Hazardous Goods Code also 
had the text-based rule fire against them; 


Readers interested in this result should consult the following report: 


e Division Report 2014 ~ 02(TR): Deliverable #4 ~ Analysis of risk rule effectiveness 
based on UN Hazardous Goods Code 
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Potential Solutions 


Knowing that these sorts of problems existed, it was thought that another useful 
direction for the Advanced Analytics team’s work would be to research cutting edge 
techniques that might serve to improve upon the current fuzzy matching process. The 
most promising direction this research took was to use data mining techniques to 
probabilistically translate the incoming text-based description into HS Codes that could 
then be compared to a list of potentially risky codes. 


it was found 
that actionable information can be fairly accurately derived from the in-coming textual 
descriptions. More precisely, in the team’s first attempt at tackling this problem, it was 
shown that a list of five candidate codes can be outputted with an confidence that 
the true HS Code would be in the list. This may sound a bit strange - typically one 
would like a more definitive answer - but when considering there are a million different 
possible classification at the six-digit level of the HS hierarchy, outputting a mere five 
candidates begins to look much more impressive. 


This work was coded completely by the Advanced Analytics team in the Python 
programming language, 


" | That being said, the next step in this 
analysis was an attempt to yield similar results by leveraging the procured data mining 
suite, IBM SPSS Modeller. 


The original code (written in Python) had a distinct advantage in comparison to using 
the off-the-shelf Modeller software because the code could be finely tuned to the exact 
domain of the problem at hand. However, despite this potential lack of domain specific 
customization, it did turn out that the IBM suite was able to generate results roughly on 
par with that of the customized code, By outputting three candidate codes (note, the 
output list was kept this small to deal with memory issues) it was possible to have 
assurance that the correct commodity is in that list. 
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e Division Report 2013 - 03(TR): An Application of Naive Bayes to the 
Classification of Commercial Cargo Declarations 

e Division Report 2015-01(TR): Deliverable #1 - Use of IBM SPSS Modeller for Text 
Mining of Cargo Descriptions. 


Conclusions 


This was done by analysing various risk rules, and using two 
internationally recognized codings (both the Harmonized System Coding and the UN 
Hazardous Goods Coding) for commodity information as baselines for the study. 


However, most importantly, the team was able to dispel the myth that the textual 
descriptions are of such poor quality that they are ill suited for use in an automated 
context. Indeed, two different methods were employed, one using technology already 
purchased by the Agency, in order to extract actionable information from the 
problematic descriptions. 


It should also be noted that with more effort, refinements and improvements to this 
work might be possible to bolster the results described herein. With that in mind all of 
the work described in this memorandum should be looked at as pointing a potential 
direction for the Advanced Analytics team's focus. 
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D1 introduce 


s the entity concept. 


Clusters of data with best quality is pulled from 
multiple trade documents and organized into 
entities — conveyance, equipment and shipment. 


A trip view is created displaying relationships 
between conveyance, equipment and shipments. 


Establishes the foundation for future 
deployments: o] o 
e Packages relevant data together to ensure timely and | | м a °° ааа 
quality risk assessment allowing users to make informed | | e CONVEYANCE 
decisions. | | — D SIGNES | | 


1098721, version 1 Dg 


o Facilitating review of shipments by risk assessing and | | Я 
applying decisions at the entity level as opposed to | | ee 
individual documents. 
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identification of shipments of interests based on Intelligence received from 
the National Targeting Centre (NTC). 


Analytical tools that seek business pattern deviations based on known 
characteristics of a companies importing history. 


Analytical tool to assist targeting operations in identifying Illegal | 
precursor chemicals. 


Assesses pre-arrival commercial data and assists in identifying shipments 
interest in the rail environment. 
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e Complete Automated Risk Assessment (all risk rules are executing and viewable) 


implementation of the Single Window trade document (Integrated Import Declaration) as a 
release option 

* Resolved identities of TCPs using Master Data Management 

e Implementation of a risk rules simulation en 


vironment - 


or the NTC to view targets and all risk results (Real Time) in all modes 


e Capability f 


* Capability to assess the operational impact of implementing new risk rules (using 
simulation) 

e The new notices provide desirable functionality to help improve communication between 
CBSA and its clients as well as business-to-business communication. 

e Validation of the Risk Assessment Model (identification of low and high risk entities) 

e Validation that the planned targeting work force can handle the volume 
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* Integrated decisions and referrals (Risk Assessment, Passage and Single Window 
Initiative) 

e Capture of examination results by front line operations 

e Introduction of Advance Trade Data (ATD) from Importers 

e Implementation of end state eManifest trade document submission 


e Complete integration of risk assessment and passage decisions between NTC and field 
operations Border Services Officers (BSOs) 

• Enhance Program integrity through “closing the loop" on examination results 

e Advance Trade Data (ATD) in all modes supports Targeting Program — provides clarity on 
what commodities are being imported by whom 

e Fully integrated commercial processing system and application, includes SWI 

° New Documents and Notices available to external clients 
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e eManifest modernizes and enhances commercial processes and screening 
of Canada-bound goods by improving the CBSA’s ability to detect 
shipments that pose a high or unknown risk, while facilitating the movement 


of low-risk shipments across the border prior to arrival. 


Data Risk — Integrated Business 
Acquisition Assessment Decision Model Intelligence 
(Passage) 


Mandating the Automating the risk Complete integration introducing 
acquisition of assessment of all of risk assessment integrated 
electronic pre- data in advance of between the NTC Business 

arrival data arrival at the border and Field Operations Intelligence 
BSOs systems 
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SA will introduce new and enhanced notification systems 


post-arrival notices to clients on commercial 


Winter 2016, the CB 
to increase automation of pre and 
movements. 


e Asubset of new eManifest notices, for EDI clients, will advise on the 
completeness of advance data submitted to the CBSA and on the arrival 
and release statuses of shipments. 

e [he new eManifest notices will be based on the overall shipment status. 

- Current notices are based on individual documents submitted by clients; Release 
Notification System (RNS) messages are based on the status of the release only. 
- The new eManifest notices will be based on the overall shipment status and 
notices will be transmitted against individual documents within a shipment 
whenever the shipment status changes. 


Adoption of the new subset of eManifest notices will be voluntary to provide 


EDI clients the opportunity to transition to the end-state eManifest notices. 
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Security 


Service 


Savings 


Government of С ап si a 


Entity Model — Pre-arrival trade data from multiple sources is compiled into nt ties’ that provide a 
complete view of the shipment. Risk assessment happens at the entity level rather than on individual trade 
documents. 

Automated Risk Assessment — Commercial entities, across all modes, are risk assessed prior to arrival. 
High and unknown risk entities are flagged to the targeting officers. Low risk shipments directed to move 
inland or released by the system. Provides the Agency with the ability to respond to threats in a more 
timely manner — hours versus weeks. ۰ 

Integrated Targeting Model — Risk assessment for admissibility and release decisions in all four modes is 
done by targeting officers at the NTC. CBSA is offered better consistency, as all modes are aligned. 


e Business Intelligence — Risk assessment results and examinations are used to “close the loop”, revise risk 
assessment rules and continually improve the risk assessment process. 


Electronic data will inform other programs to enhance their risk assessment. 


| Integrated Targeting Model — Risk assessment for admissibility and release decisions in all four modes is 
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assessment rules andi bud improve the risk € соо, process. 


` Electronic data will inform other programs to enhance their risk assessment. 


integrated Targeting Model — Risk assessment for admissibility and release decisions in all four modes is 
core by targeting officers at the NTC. CBSA is offered better consistency, as all modes are aligned. 


Business Intelligence — Risk assessment results and examinations are used to “close the loop”, revise risk 
assessment rules and continually improve the risk assessment process. 
` Electronic data will inform other programs to enhance their risk assessment. 
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Service * Electronic Data Interchange — Trade Chain Partners electronically transmit 
advanced commercial information, which can be used in communication with 
other trade chain partners. | 

* Predictability — Risk assessment prior to arrival provides predictability for trade. 

e Consistency — National integrated targeting provides trade with consistency, as 
all modes in the Commercial process are aligned. 

* Facilitation — focus on high risk shipments for targeting and inspection facilitates 
the legitimate flow of low-risk trade. 

* Ability to cleanse data reduces costly requests for information (RFI) to Trade. 
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ntelligence officers / targeting teams in the 
National Targeting Centre (NTC) in the mining of the existing and historical 
trade data se 


* Capability for the NTC to assess risk based on historical trend analysis (e.g. 
anomalies in a companies Business Profile — pattern and trend deviation) 

° Identification of ‘candidate’ risk indicators (e.g. use analytics to develop new 

ules based on vessel routing patterns, container delivery address) 

e Modifi 
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ta of Automated Risk Assessment 
Introduction of the risk results User Interface (01) that supports the viewing of 
є shipments _ 


° етемш ion wer High F Risk Com amme no 
_ Assessment of shipments 


all Vnd 

e Supports the ability to target or interdict high risk shipments using legacy 
Сотона чив 
Ability 
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e Capabi lity fc ior the NTC t tov view targets and all risk results (Real Time) in all modes 

e Capability to assess the operational impact of implementing new risk rules (using 
simulation) 

* The new notices provide desirable functionality to help improve communication between 

CBSA REM bs о а$ well: as lesa cr ето 
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Integrated decisions and referrals (Risk Assesment Passage: ar nd Si a Window 
Initiative) - o 

Capture o examination results by front line operations 

End-state notices via Electronic Data Interchange and eManifest Portal 
Introduction of Advance Trade Data (ATD) from Importers 

ementation of end state eManifest trade document submission 


ре 


Complete integration of risk assessment and passage decisions between МТС апа field 
operations Border Services Officers (BSOs) 
Enhance Program integrity through “closing the loop” on examination results 


Advance Trade Data (ATD) in all modes supports Targeting Program — provides clarity on | 


what commodities are being imported by whom 

Fully integrated commercial processing system and application, includes SWI 

New Documents and Notices available to external clients 

The eManifest system becomes the new system of record 

Full Benefits Realized for TCPs (Manifest Forward, Streamlined Border Processing) 
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e Ri ik a Mise and rini idi it Reports 
e Passage: О H 
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Canada Border 
Services Agency 


Agence des services 
frontaliers du Canada 
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CBSA - Released under the Access to Information ac 


ee -Apr 2014- -July 2014-Oct 2015-Јап 2015-Apr 2015-July 2015-Oct 2016-an 2016-Арг 2016-July 2016-Oct 


- 
i 

$ 3 

: і 

Н 

{ 

: : 

E 

i 

ў 


RSS ATA i sh ДОА ОАА EN 


Collecting information to prepare 
for r risk assessment 


ПАННО 


€ 


——— 


Business ^ 
information | 


Capacity for À NTCt to ASSESS risk based an о! vend analysis. 


Capability for NTC to view all target and 
risk results eManifest Notice for TCPs 


Capabi ility for г NTC tc to view | 
commodity risk results : 
. {Real time) 


The integration of risk assessment and 
decisions between NTC and field 
operations (8505) 
Benefits realization for the TCPs 


ERR WERE RE EE SEE УКК КККК, 


D5 


eae eee ae eae AIN PORTO ANA are 


D6 


Operational / Performance Reports (Targeting) 


Performance and Operational Reporting 
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D1 introd 


uced the entity concept. CONVEYANCE Eny Package 


Clusters of data with best quality pulled from 
ultiple trade documents and organized into 


entities — conveyance, equipment and shipment. 


Бану HY 1122449 Version 1 оо 
Карен M Pun der SCRHT-20140513113 1332 PR EO 201 140513 3113123 


A trip view is created displaying relationships 
between conveyance, equipment and shipments. 


Established the foundation for future 
deployments: 


e Packages relevant data together to ensure timely and 
quality risk assessment allowing users to make informed 
decisions. 


e Facilitating review of shipments by risk assessing and 
applying decisions at the entity level as opposed to 
individual documents. 


e Risk results, decisions, referrals, and exam results are all 
associated to the entity enhancing the capability to perform 
analytics to improve future risk determination (Le. "closing 
the loop"). 
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identification of shipments of interests based on Intelligence received from 
the National Targeting Centre (NTC). 


Analytical tools that seek business pattern deviations based on known 
characteristics of a companies importing history. 


Analytical tool to assist targeting operations in identifying illegal s 
precursor chemicals. A 


Assesses pre-arrival commercial data and assists in identifyin 
interest in the rail environment. 
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ssment” 


Deployment 3 is the foundation for commercial risk assessment: 


ОЗ provides the NTC with the opportunity to use the new capability in а 
operational environment and to provide feedback for future (D4/D5) 
deployments; 


D3 delivers the ability to perform automated risk assessment for shipment 
entities in all four modes using Commodity based risk indicators; 

e D3 will help shape operational processes associated with using a business 

rules engine to create, modify and/or turn off commercial risk rules based on 

orformance or emerging threat categories; and 


e Introduce the new commercial targeting system (Phoenix) for 
searching/viewing risk results. 
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DUE ини aU AS 


м 


teg ra ted Decision Model” 


to process commercial shipments as they enter Canada 


Full integration of Passage and new risk assessment systems 


Introduction of Advance Trade Data (ATD) from Importers 


state notices via Electronic Data Interchange and eManifest Portal 


Implementation of end state eManifest trade document submission 


am integrity through “closing the loop” on examination results 
eManifest systems become 


s the new systems of record 


| benefits realized for TCPs (Manifest Forward, Streamlined Border P 


and internal stakeholders (streamlined examination results, better application 
usability, etc.) 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


September 03, 2015 
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E 


maintenance funding. 
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i 2 has been achieved with the 
successful completion of two releases: 


on the new EL DW Арон lance with pe ng data be to 
demonstrate the business value of moving to a 24 hour refresh rate. 
Production Date: October 22, 2014 
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, 2014 
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analysis be 
to recover the project with full business benefits. 


In March three Options for moving forward were identified and an Option Analysis was 
undertaken. The following three Options for moving forward were identified: 


— This option introduces a new delivery model designed to deliver business benefits early by 
augmenting the project team competency and capacity with different forms of vendor relationships 


In April the Executive Committee (EC) approved moving forward with Option 2 and the project 
team proceeded with the development of the detailed planning, risk mitigation and third party 
endorsement activities. 


In June, the new delivery approach was approved by EC. 
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elivery approach is supported by CBSA resources and is augmented with 
external support to do parallel work that will generate early, tangible benefits to 
confirm development milestones are being met and provide support for front-line 
operations. 


The revised plan will provide additional time to train CBSA staff and conduct outreach 
to external stakeholders to ensure a successful implementation. 

The plan addresses external clients’ requests for more time to make changes to their 
internal business processes and systems in order to adapt to the new requirements. 
Delivery Scope is segmented into six (6) Deployments to ensure Business Benefits 
are delivered earlier in the cycle 


* Incremental stakeholder exposure to functionality as early as Deployment 2 (and 
continuing with each deployment thereafter) 

Risk mitigation to “Big Bang” approach - newly deployed eManifest system 
operations to run in parallel with legacy systems until Deployment 5 

e SWI is fully integrated with eManifest — begins in Deployment 4 and is fully 
integrated and deployed as a part of Deployment 5 

* Crew and electronic re-manifest requirements have been removed from scope 

il ivered as a part of the larger CBSA border modernization program 


and will be de 
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Deployment of eManifest Functionality 


Data Acquisition 
for Freight Forwarders 


Data Warehouse & 
inalytics Phase 1 


Web Partal 
for Highway 


leme PRE-vequisites 


Data Acquisition 
for Highway 


Data Acquisition 
for Rail 


Over 11,000 hi айна carriers now 
engages wi in eMani lest 


D ail | Wm А 
v eMani fest Portal 

¥ Freight Forwarder Reporting 
v Air and Marine Conveyance Arrivals Regional network in place 

Y Manifest Forward Established a program ali ligament 

V Data Warehouse structure to resolve outstanding issues 
v Webinars, web content, presentations 


egulations progressing 
Multiple rounds of training for Bs 


<< < < < 
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— The ability to collect pre-arrival crew information for risk assessment and 
targeting was a commitment in the eManifest business case; descoping imposes 
the continued need for paper based manual review and targeting. 


Delivery mechanisms will be sought through a maintenance release and/or joint 


initiatives in travellers stream to deliver on the commitment. 


Hivi: 


e  He-Manifest 


Functionality for carriers to submit re-manifests electronically through ED 
Portal. The CE 


| or the 
ISA requires a re-manifest to track transfers in liability between 


carriers or when goods are changing destination / warehouse location. 

- The agency is reviewing the business value of re-manifest in light of agency 
transformational initiatives; stakeholders support this review as it offers business 
process efficiencies. 

— Possible opportunity in changing requirement through the Cargo Control and 
oufferance Warehouse Modernization Initiative 
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“Capability for Nic ta view ail ps and | 
risk results eManifest Notice for TEPS 
{Real Time Data & Autamated Risk 
Assessment moves to maintenance] 
SWI ~ integrated Importer Declaration 


| Capability for Nic to view 
commodity risk аз 
ИИИ (Real time ИИ 
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— ОО ОУ УУ — 
The integration of risk assessment and 
decisions between NTC and Held 
operations (BSOs] 

Panete n for the TCPs 
~ fully integrated 
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pasione History Supported ne Busin iness | intelli igence : 
Operational / Performance Reports) | | 


i m Targeting y Ri sk Astessmént 
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Cumulative percentage of Business 
Functionality acrass Deployments 


Performance and Operational Reporting 
Real time pattern & trendi ing data through queries 
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utem ‘ASFC:= Divulgatiorren vertu de la loi sur l'Accès à l'information. 


“Core Information Business Model" 


ө Electronic D Data Capture 


e Laying the foundation to prepare the trade documents to support risk assessment 


ш entity relationships) 


Descr шоп of the أ‎ Risk Wt nodi үг identificati ion supported by Language 
ү Аш. data preparation ur ce b Quality Stage—Address Verification 
Interface (QS-AV VI) 


ө Vali atic ion n that the c core bus iness Rel db is sound 
Vali 


abi lity Ы resolve an address س‎ supports risk ules a look for commerci al shi pment 
destined to residential address, determine what type of commodity is being reported 
on the manifest) 


¥ Implemented in Production — Jun 
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‘Data Analytics” 


ics capability to assi ist mn p : PRA teams i in the 


Data ta Analytics 


Capability for the NTC to assess risk based on historical trend analysis (e.g. anomalies 
in a companies Business Profile — pattern and trend deviation) 

Identification of ‘candidate’ risk indicators (e.g. use analytics to develop new rules 
based on vessel routing patterns, container delivery address) 

Modification of existing indicators based on analysis / outcomes and new data feeds 


© desse 28: ii 2015. 


Deployment 2C: February 2 2 
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_ implementation of High Risk Commodi ity rules to 17000 Automated Risk Assessment 
of ship Y ents | "o 


| Азоби rent" 


"Commodity Ri 


Start of Automated Risk Assessment | 

Introduction of the risk results User Interface (Ul) that supports the viewing of 
shipments - 

Provide the ability to view and modify High Risk Commodity rules 


Capability for the NTC to view High Risk Commodity risk results (Real Time} in all 
modes; 

Supports the ability to target or interdict high risk shipments usi Ing legacy commercial 
systems 


Ability for the Program to assess the performance of High Risk Commodity rules in 


new system vs. legacy system 


Validating and improvi ne ae Automated Ri sk Assessment results 
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Implementation of initial eManifest new notices for Trade Chain Partners ( 


lete Automated Risk Assessment (all risk rules are executing and viewable) 
CPs) 
plementation of the Single Window trade document (Integrated Import Declaration) 


T CPs using Master Data Management 


Implementation of a risk rules simulation environment 


Capability for the NTC to view targets and all risk results (Real Time) in all modes 
Capability to assess the operational impact of implementing new risk rules (using 
simulation) 

The new notices provide desirable functionality to help improve communication 
between CBSA and its clients as well as business-to-business communication. 
Validation of the Risk Assessment Model (identification of low and high risk entities) 
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Decision A Jodel i 


"Integrated L 


ө Integrated decisions and referrals (Risk Assessment, Passage and Single Window 
Initiative) 
e Capture of examination results by front line operations 
e End-state notices via Electronic Data Interchange and eManifest Portal 
- Introduction of Advance Trade Data (ATD) from Importers 
nee Implementati ion of end state eManifest trade document submission 


M Completa i integration of ri risk assessment and passage decisions between NTC and field 
operations Border Services Officers (BSOs) 

e Enhance Program integrity through “closing the loop” on examination results 

e Advance Trade Data (АТО) in all modes supports Targeting Program — provides clarity 
on what commodities are being imported by whom 

* Fully integrated commercial processing system and application, includes SWI 

• New Documents and Notices available to external clients 

The eManifest system becomes the new system of record 

e Full Benefits Realized for TCPs (Manifest Forward, Streamlined Border Processing) 
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D! mpletion of components such 
as risk assessment : and data acquis ition to create efficiencies in 
d itd of the — ere | ents 


rate together to 


е the full ani realization 
2nd-state el Aanifest t trade documents will be delivered in 
DS to o align with the new ¢ sysiem and avoid redundant costly work on 


mp: ihe talig igning ri isk 
e od ! syste m of record 


000288 


CBSA - Released under the Access to Information Act. 
sentant esee —————— : ху КОТУР: TEM ТОРТИ Ер з ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Operational 
Management 


E 


E 


Capture of 
examination 
results by front 
line operations 


Deployment 5 


Integrated di ui 
decisions and : 
referrals (Risk 
Assessment, 
Passage and 
SW) 


End-state notices 
via EDI and 
eManifest Portal 


End state 
eManifest trade 


Deüverable Business Acceptance 


submission 


Showcasing of Deliverable 
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* Target Snapshot, Business Profile Supported by Business Intelligence for 
. Targeting / Risk Assessment 
_ Passage History Supported by Business Intelligence 


e Program Performance and Operational Reporting 
e Business Intelligence — Self Serve Model 
Real time pattern & trending data through queries 


e Target Production Date: 
e Deployment 6A (aligns with D4 production): December 2015 
e Deployment 6B (aligns with D 
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Gartner has been asked to assess the eManifest recovery plan. 
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ble recommendations. 


This limits the analysis and poss 
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The Architecture supports the realization of business benefits for eManifest. 
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Non-functional requirements and the ability to meet them have yet to be confirmed. 
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roject success will depend on prioritization of eManifest within the Agency. 
The magnitude of risk and change management is not fully appreciated. 


_ v Procuring and managing complex outcome-based supply arrangements would prove 
| z ee | 


very risky, given CBSA’s current level of vendor management maturity. 
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— External stakeholders will be advised of the new delivery plan with dates 
~ A full communications strategy will be developed once the plan is approved 


nternal Stakeholders 
— Present re-baselined plan to CIOB 
— Briefing to TB 


e Minister's Office 


~ Provide an update on eManifest status and plan, impacts on BtB commitments, external 
stakeholders and regulatory package 


e PCO 
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e Project Development Lifecycle will see shifts in resource allocation 
?roject moves through Development and inte 


and skillsets as the H 
Testin Q & Im D lementation 


e Business and Systems Analysts will begin transitioning to 
Maintenance & to new NH work through this fiscal and into 
2015/2016 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


May 9, 2014 
Version 1.0 
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Capability tor NTC to view ali target 
and risk results eManifest Notice for 
TCPs 


"— —" {Real Time Data & Automated Risk 
Capabili ity for NTC to view _ | Assessment moves to maintenance) 
commodity t Шә results : D 5 "—————— — 
D {Real ti м me) | | нй RP RU ESS 
ВЫ The арган on - risk — 1! 
| assessment and decisions 
| between NTC and field 
operations (8505) 


Benefits realization for 
es Tos 


Integrated Decisi on Model 
includes Phoenix & Passage) 


Intelligence 
Operation / Performance. Repo Es) Jp 


Performance and Operational Reporting 


Cumulative percentage of Business [ 
Real time pattern & trending data through queries | 


Functionality across Deployments 
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Deployment 1 
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Deliverable Business Acceptance 


Develop & run 
analytics 
current data 


eployment 2A 
Production 


Showcasing of Deliverable 


+ 


sources РРА October 9, 2014 


> 


Sept 16, 2014 
March 24, 


Deployment 2B 
Production 


Develop and 
run analytics 
on D3 data 
feeds 


Transition 
April 24, 2015 


еріоутепї 2C 

Production 

January 8, 
2016 


Develop and 
run analytics 
on D4 data 
feeds 


Transition 
Nov 6, 2015 
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Production 
June 8, 2015 
Commodity І | | : 


Assessment 


Deliverable Business Acceptance 


showcasing of Deliverable 
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Operational June 2, 
Management 


2015 


Capture of 
examination 
results by front 
line operations 


Integrated 
decisions and 
referrals (Risk 
Assessment, 
Passage and 

SWI 


H 


End-state notices 
via EDI and 
eManifest Portal 


ess 


End state 
eManifest trade 
document 
submission 


June 1, 2016 


z us Юй Шу ЮУ 
Se EE Sr 


Transition 


Deployment 5 
~ Production 
November 17, 

2016 
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Deliverable Business Acceptance 


Showcasing of Deliverable 
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: Aligned wit! 
Deployment 
Production 
November 6, 
Transition 2015 | 
Aug 20, 2015 
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Deploymen 
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TERRAS 


igned with 
Deployment 5 
^ Production 
* November 17, 
2016 


Transition 
une 1, 2016 
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Reports 


Deliverable Business Acceptance 


Showcasing of Deliverable 
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К 


lop and execute analytical models 
on Program / Operational priorities 


using current data sources. 


Demonstrate that analytical models can 


support Targeting and Intelligence 
gathering using new data feeds. 


Develop candidate risk indicators or 
modify existing indicators based on 
analysis / outcomes and new data feeds. 


e 


© 


Run analytical models using 


appliance 


current data sources 


Run analytical models against current 
and new data sources from 
Deployment 3 


Run analytical models against current 
and new data sources from 
Deployment 4 
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Develop & execute analytical models based on Program / 
Pre Transition Operational priorities using current data sources — Business 
Acceptance 


Transition Deployment Transition Readiness 


Production Deployment Production 


Demonstrate that analytical models can support Targeting 
Pre Transition and Intelligence gathering using new data feeds — Business 
Acceptance 


йу existing 
is , е / осот m es s and new data 


Production — Depl loyment Productio 


August 27, 2014 


September 9, 2014 
October 9, 2014 


March 24, 2015 


August 6, 2015 


November 6, 2015 
January 8, 2015 
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Pre 
Tran sitio n 


Transition - 


Production 


Hisk Indicator Rules for Commodity Shipments 
(Viewing, Authoring and Deploying using ODM) 


— Business Acceptance 


December 15, 2014 


Commodity R 
Acceptance 


June 8, 2015 
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Complete Risk Assessment e Comprehensive Hi 
(Execution and viewing) e Target 


laintenance 


Perform impact analysis of risk rule 
changes using simulation 
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Create eManifest end state notices 
(create and view) — Business Acceptance 


October 8, 2014 
Capture 10 trade document 
(create and view) — Business Acceptance 


` Pre Resolved identities Trade Chain Partners using 
` Transition MDM - Business Acceptance 


December 8, 2014 


January 27, 205 


Complete Risk Assessment 
(Execution and viewing) — Business Acceptance 
о 


7: . “ie ж 
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Operational Management 


Capture of examination results by front line 
operations 


Integrated decisions and referrals (Risk 


Assessment, Passage and SWI) 


о 


Risk апа Passage Superintendent 


Integrated Front Counter and 
secondary Decision 


Integrated PIL Decision 
Single-Window Integration 
Transition from ACROSS/ 
eManifest 


External Client Communication 


External Client Communication 
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Operational Management — Business Acceptance June 2, 2015 


Capture of examination results by front line 
operations — Business iac icai 


| p February 15, 2016 


March 29, 2016 


Transition Deployment. 


Transition à Reach Iness June 1, 2016 


Production Deployment Production — |. November 17, 2016 
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Risk Assessment Reports — Business Acceptance August 13, 2015 
Pre 


Transition Operational Business Intelligence Reports to support 


Phoenix and Target Maintenance — Business August 13, 2015 
Acceptance 


Transition August 20, 2015 


r6,2015 


March 29, 2016 


June 1, 2016 


November 17, 
2016 
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| 
i 
| 


Collecting information 
to prepare for risk 
assessment 


Capability for NTC to 
assess risk based on 
ni storical trend analysis 


Data Analytics 


The integration of risk assessment and decisions 


oe | | between NTC and field operations (BSOs). 
Ca pabi lity for NTC to view 


| D commodity risk results 


Уйу for NTC to view all target 
and risk results 
(Real Time/move to maintenance). 


SAR RE RER RER rer 


eMani ifest Noti ice for TCPs 


RER 


March 20, 2014 V3.0 = 
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March 20, 2014 V3.0 
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Risk Assessment using the Business Information Model. 


e Provide the risk assessment results to the Intelligence Officers in the NTC. 


e Utilize the Business Analytics to identify new Commodity Risk Rules 


e Provide the ability to modify the Commodity F 
of a normal release cycle. 
— ODM Decision Center 


isk rules in production outside 


* 


mation Model and Commodity 


e Provide a read-only view of the 
Risk results (Phoenix). 


Transition of Bus M dity risk results to the 
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(Stream #4) 


e End-State Risk Assessment using the Business Information Model. 

e Provide the risk assessment results to the Intelligence Officers in the NTC. 

e Provide the ability to modify all Risk rules in production outside of a normal release cycle. 

e Utilize the Business Analytics to identify new Risk Rules 

e Provide the ability to utilize identity resolution to support Party based risk assessment: 

— MDM 

e Provide the ability to manage and execute targets. 

e Extending the Business Information Model to support all current trade document including 
IID. 

e Provide an enhanced read-only view of the Business Information Model and Risk results 
(Phoenix) including user workload filters through the identification of low risk (ELR). 

e Provide the ability to determine the operational impact of risk rule changes through 
simulation. 

e Early delivery of eManifest end-state notices using legacy technology (ACROSS) 

e Transition of Business Information Model and risk results to the data analytics environment. 


March 20, 2014 V3.0 
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Integrated Decisions using the end-state | 


March 20, 2014 V3.0 


(Stream #5) 


Business Information Model. 
Provide an integrated view of the Business Information Model and Risk | 
front-line BSOs (F 


Passage), the NTC targeting officers (Phoenix) and the Risk 
Assessment Program officers (НАРМ). 

Provide the ability for the front-line BSOs (Passage) the NTC targeting officers 
(Phoenix) to make integrated operational decisions using the end-state Business 
Information Model. 

Extending the Business Information Model to support the end-state trade documents. 
Provide the ability to record referral details and examination results. 

Deliver eManifest notices using the end-state Business Information Model while still 
supporting the legacy notices. 

eManifest Portal enhanced to use the end-state Business Information Model. 

Legacy application (ACROSS/TITAN) downsized. | 

Transition of Business Information Model, risk results and decisions to the dat: 
analytics environment. 
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(Stream #6) 
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* 


e On April 24, 2014 Options Analysis for eManifest Project F 
presented to Executive Committee (EC) 


Recovery were 


¥ 


e EC approved the project team to procee ailed planning, risk 
mitigation and third party endorsement activities for Option 2 - a hybrid delivery 
model addresses four (4) main risk areas and focuses on augmenting the 
current team competency and capacity with different forms of vendor 
relationships 


e On May 9^ 2014 a draft Detailed Project Plan with costs was presented to the 
AVP ISTB 


e Оп May 30" 2014 preliminary findings from the 3" party risk mitigation activities 
(architecture review, benchmarking, and sourcing analysis) were delivered 


e On June 9^ 2014 the 3" party draft risk assessment report was delivered 
identifying remaining risk areas for the Option 2 Detailed Project Plan 


e On June 12^ 2014 the final 3" P 


arty risk assessment report was delivered with 


key recommendations for moving forward 
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¥ Тһе new delivery approach is supported by CBSA resources and is augmented with 
external support to do parallel work that will generate early, tangible benefits to | 
confirm development milestones are being met and provide support for front-line 


operations. 


Y The revised plan will provide additional time to train CBSA staff and conduct outreach 
to external stakeholders to ensure a successful implementation. 


equests for more time to make changes to their 
йй а Hbri processes sand derinin in order to adapt to the new requirements. 
Delivery Scope is segmented into six (6) Deployments to ensure Business Benefits 
are delivered earlier in the cycle 


* Incremental stakeholder exposure to functionality as early as Deployment 2 (and 
beue wi nn each Sepleymen e 


Big E | loyed eManifest system 
operatore i run in n parallel w ith legacy ee until — oyment n 


MORE d 


" =. and electronic re-man \їезї requirements have been removed from scope 
ind will | ! dernization program 
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Deployment of eManifest Functionality 


Data Acquisition 
for Freight Forwarders 


Data Warehouse & 
Analytics Phase 1 


Web Portal 
for Highway 


T 


Data Acquisition 
for Highway 


Data Acquisition 
for Rail 


Cat 11 000 aC carriers now 
engaged with eManifest 


97% of sag 500 шк + engage 
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v Webinars, web content, presentations 
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e Crew 


— The ability to collect pre-arrival crew information for risk assessment and targeting was a 
commitment in the eManifest business case; descoping imposes the continued need for 
paper based manual review and targeting. 

— Delivery mechanisms will be sought through a maintenance release and/or joint initiatives in 
travellers stream to deliver on the commitment. 


o  He-Manifest 


— The agency is reviewing the business value of re-manifest in light of agency transformational 


initiatives; stakeholders support this review as it offers business process efficiencies. 


— Possible opportunity in changing requirement through the Cargo Control and Sufferance 
Warehouse Modernization Initiative 
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“Core Information Business Model” 


-Address Verification . 


ation that the cor 

e Validation that the implemented COTS products provide the expected capability (e.g. 
ability to resolve an address — supports risk rules that look for commercial shipments 
destined to residential address, determine what type of commodity is being reported 
on the manifest) 


* Valid 
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‘Data Analytics’ 


e Data Analytics capability to assist intelligence officers / targeting teams in the 


National Targeting Centre (NTC) in the mining of the existing and historical trade data 


e Modification of existing indicators based on analysis / outcomes апа new data feeds 


31-1 


ы ane 2А: October 2014 
e Deployment 2B: June 2015 _ 
e Deployment 2C: February 2 


000332 


mies 

e Supports the ability to target or interdict high risk shipments using legacy commercial 
systems 

* Ability for the Program to assess the performance of High Risk Commodity rules in 
new system vs. legacy system 

ө Validati ing and i improving the Automated Risk Assessment results 
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gren 


e Capability for the NTC to view targets and all risk results (Real Time) in all modes 

e Capability to assess the operational impact of implementing new risk rules (using 
simulation) 

e The new notices provide desirable functionality to help improve communication 
Wm. CBSA and its clients as wen as hod э ч communication or 
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ө Complete integration 6 af ri isk assessment and passage decisions between NTC and field 
operations Border Services Officers (BSOs) 

e Enhance Program integrity through "closing the loop” on examination results 

e Advance Trade Data (ATD) in all modes supports Targeting Program — provides clarity 
on what commodities are being imported by whom 

* Fully integrated commercial processing system and application, includes SWI 

e New Documents and Notices available to external clients 

e The eManifest system becomes the new system of record 

* Full Benefits Realized for TCPs (Manifest Forward, Streamlined Border Processing) 
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e Program Performance and Operational Reporting 
Business Intelligence — Self Serve Model 
Real time parem & ne data through querie 
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Gartner has been asked to assess the eManifest recovery plan. 
This limits the analysis and possible recommendations. 


The Architecture supports the realization of business benefits for eManifest. 
Non-functional requirements and the ability to meet them have yet to be confirmed. 


Past project delivery issues have been identified and risk mitigation actions developed. 
Executing those actions will be challenging. 


Project success will depend on prioritization of eManifest within the Agency. 


Procuring and managing complex outcome-based supply arrangements would prove 
very risky, given CBSA's current level of vendor management maturity. 

Executing new sourcing approaches may not yield the value being sought within 
eManifest's timelines. 


CBSA - Released under the Access to Information Act. 
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External Stakeholders 
~ External stakeholders will be advised of the new delivery plan with dates 


Minister's Office 
~ Provide an update on eManifest status and plan, impacts on BtB commitments, external 
Stakeholders and regulatory package 


PCO 
— Continue to update BIB team of eManifest status and impacts on BtB commitments 


Staff and Unions 
— Communication of the HR Strategy with staff and unions will begin once plan has been approved 


SSC 


~ They are on the recovery team but will also be formally briefed on the approved plan 
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Project Develop! LI 
and Ski веі as the Р Project m 
| J & Implementation 


ems Analysts will begin transitioning to 
w project work through this fiscal and | 


Business and 
M aintenance & to ne 
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ommercial Projects Directorate 
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CBSA - Released under the Access to Information Act. 
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RIVAL 


PASSAGE 


^ DATA WAREHOUSE | 


Business Intelligence Tools to suppart 
continuous improvements to risk : 
assessment to adapt to changing rísk 
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> 


| 

i 
| Pre-arrival advance information | Centralized targeting based on rigorous | Enhanced Passage application for 

| from all Trade Chain Partners for risk assessment | BSOs including GUI technology 
all modes | , 
environment. 
| . : - Automatically screen commercial e introdi e fagranhica 
# Electronic reporting environment | Z shipments E indications of risk Ж | j о pn vis у ы. 
(Electronic Data Interchange and | E à mn | | User Interface (GUI) for BSOs 
departure for Canada. 


Manifest Portal) in which + у. die 
VA bee | | | ж identify high or unknown-risk “entities 
carriers, freight forwarders, | е о А 
brokers and importers will ۰ shipments, conveyances, equipment 
2 d E | while facilitating the flow of legitimate 


electronically transmit lov Aek trade: » Provide CBSA officers with a 
| 


^ Strengthens and modernizes 


CBSA risk assessment systems 


| working at Primary Inspection | and processes. 


Line, Front Counter, and 
Secondary Examinations. 
pattern and trend analysis and 
reporting capabilities to support 
commercial programs , 
compliance monitoring and 
performance measurement, 


Ш rio à cn ү» Aine ee MES Enhanced ability for CBSA to risk assess user-friendly interface to the | 
B ee ds 18 апе ees more effectively and direct resources to many supporting systems. : 
admissibility data. | О ОСОНИИ NM 
| shipments, conveyances, equipment 
» Portal provides the foundation for | posing the highest risk to Canada's 
future CBSA web applications. health, safety and security. 


> integrate decision making and 
examination resuits capturing 
processes (closing the loop). 


ғ“ Expands information analytics, 
| 
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Dep э t 1 (Core Information E B 
2 Deployment 2А. | 
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Deployment of eManifest Functionality in P 


Data Acquisition 
or Freight Forwarders 


Dota Warehouse & 
| Analytics Phase 1 


Web Portal 


e Data Analytics 
re-requisites ow jor Highway 


AC! Air & 
Marine 


Data Acquisition 


Phoenix; 
Commodity Risk 


Data Acquisition 
for Rail 


Core information 
Business Model 


Implementation Highlights: 


Y Моге than 8,600 highway carriers engaged 
with eManifest, representing 96% of all 
electronic and paper highway volumes 

v Воће 11 rail carriers engaged with 
eManifest 


"4 

v 

r Air ir rand Mari bz Co nveyance Arrivals with Manifest and client аке осе а to 
VM fantiest Forward increase 
4 
v 
^^ 


Y Multiple rounds of training for BSOs have 
been delivered and an effective regional 
support network is in place 


Data Ana З v Webinars, Web content, presentations 
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Capability for NTC to view all target and 

risk results eManifest Notice for TCPs 
(Real Time Data & Automated Risk 

| Assessment moves to maintenance) 

| SWI- Integrated Importer Declaration 


| Capability for NT to view 
commodity risk results 
{Real ti time 


55 а ОО ) ОООО 


_ "— 4: | The integration of risk assessment and 

: : decisions between NTC and field | 

operations (BSOs) | 
Benefits realization for the TCPs 


Performance and Operational Reporting 
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| Ws г: p i r f ice rs inc clear ar manner; reduces nee for R a 


M Provide Data Analytics capability to assist intelligence officers / e Allows more per largo by the Agency; avoids false 
Deployment 2 targeting teams in the National Targeting Centre (NTC) in the positives that can result in examinations or Requesis For 
(October 2014) mining of the existing and historical trade data. information 


information 


° Соро Automated Risk Agsdaatiant t (al | пек! rules are executing * Improved identity resolution within targeting system (reduces false 
апа viewable) | | positives) 
M New disposition notices to Trade advising of status of shipment * implementation of initial eManifest new notices for Trade Chain 
» Integrate border processes with Single Window Initiative Partners (TOPs) 
s implementation of the Single Window trade document (Integrated 
Import Declaration) as a release option 


Deployment 4 
(December 2015) 


.* introduction of Advance Trade Data (АТО) from Importers 


Deployment 5 ы Compl ete integration of risk assessment and passage decisions • Fully integrated commercial processing system and application 
(December 2016) ` between NTC and field operations * New Documents and Notices available to external clients 
M Advance Trade Data in all modes supports Targeting Program * Full Benefits Realized for TCPs (Manifest Forward, Streamlined 
° The eManifest system becomes the new system of record Border Processing) 


а Provide the Agency with the following reporting capabilities: * Provides Programs with reports to measure effectiveness; 
- Operational and Management Risk Assessment Reporting strengthen Program Integrity — better understand Service Level 
Deployment 6 - Operational and Management Reporting for Passage impacts on Trade 
(December 2016) - Program Performance and Operational Reporting 
* increased Decision Support far Programs 
Ability to generate compliance monitoring reports 


Li 


Implementation of end state eManifest trade document submission 
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CBSA will launch the 
: "arts 1 & 2 thai will 


ail (Cargo and Сопуе Information) 


e Part 2 — — Freight Fo Warder (Supplementary Information — 
Electronic | төзер Il) 
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[here are 14,314 active 
highway carriers through FY 
14-15. 


Participants 


geManifest 
Participants 


Of the active highway 


ers, 8,666 are eManifest 
ready in production, 


14,314 Active Highway Carriers 


ding inactive or 
ed in the eManifest 
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reight forwarders are engaged in eManifest and Portal 
— Qn" EDI Client Registrations eManifest Porta 


Client 
[Jan 2015] Registrations | 


AMAA 


Total « 44 Total = 275 
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— The eManifest project has an approved budget of $415.1M. 


Fiscal 2014/15 actuals are reporting $38.8M with a forecast of $41.4M for 
2015/16 and $39.9M for fiscal 2016/17. 


the Deployment 4 (D4) production dates on May 6, 2015. D4 will be delivered in 
two releases. 


— To date we have 43 approved request for change with an estimated 2599 effort 


days and an estimated cost of $1.574M. 
During P1, we have approved one RFC that has added an estimate 44.3 effort 
Dep 5) and an estimated cost increase of $26K. 
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e Issue 


— The project is currently tracking 3 open issues; 
1. (IL-118) Roll-out for SPSS software upgrade to V16 has encountered 
delays. 
ə Resolution Plan: Options analysis underway. Escalated to management for 
direction and resolution. 


2.  (IL-117) The SWI maintenance release will create resource contention for 

D4 as the ACROSS team will be dedicated to the maintenance release and 

production support. 

и Resolution Plan: Resource levelling exercise is on-going to asses gaps in 
resourcing to minimize impact. 


3.  (IL-112) There is resource contention between D4 and DS projects. 


e Resolution Plan: Use staff augmenting supply arrangements to fill resource gap 
where necessary. 
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“Core Informa tion Business Model’ 


e Validation that the core dud iness design is sound 

ə Validation that the implemented COTS products provide the expected capability (e.g. 
ability to resolve an address — supports risk rules that look for commercial shipments 
destined to residential address, determine what type of commodity is being reported 
on the manifest) 
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‘Data Analytics” 


feeds 
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273 


ө Capabilit ty fc for t the NTC t to view High Risk Commodity risk results (Real Time) in 
all modes; 

e Supports the ability to target or interdict high risk shipments wine legacy 
commercia ai de a d 


h Risk Commodity 


| nites | in new systen vs. legacy bys em 
e Validating and improving the Automated Risk Assessment results 
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Capability fc a her NTC t to^ view targets and all risk results (Real Time) in all modes 
Capability to assess the operational impact of implementi ing new risk rules (using 
simulation) 

Ther new gs Ices * xs desirable пету to ep improve ko cud between 


Vali dati ion i the Risk Assessment Model (i dene ficat ion of low and high risk entities) 
Validation that the planned targeting work force can handle the volume 
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Complete integ latio ion not rick assessment and passage decisions between NTC and field 
operations Border Services Officers (BSOs) 
Enhance Program integrity through “closing the loop” on examination results 


Advance Trade Data (ATD) in all modes supports Targeting Program — provides clarity on 


what commodities are being imported by whom 
Fully i integrated commerçial Mos т System and application, includes SWI 
New [ clients 

The eManifest үс becomes the new DNA of record 

Full Benefits Realized for TCPs (Manifest Forward, Streamlined 


Border Processing) 


000366 


ө Program B лсе апа Operational Reporting 
e Increased Decision Support for Programs 
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CBSA - Released under the Access to Information Act. 
ivulgation en vertu de la loi sur l'Accès à l'information 


Canada Border Agence des services 
Services Agency frontaliers du Canada 


rotected B 
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Web Portal 
for Highway 


ACI Air & | Da ta Аса uisition Data Acquisition y Core information F Phoenix; 
Marine ٠ for H ighway for Rail d Business Мене i. i Commodity Risk 
Assessment 


Systems Deployed implementation Highlights: 
v away pum and Conveyance "Y Моге than 8,600 highway carriers engaged 
Heporting with eManifest, representing 96% of all 
Rail Reporting electronic and paper highway volumes 

el ian fest Portal ¥ 8 ofthe 11 rail carriers engaged with 
eManifest 
¥ More than 300 freight forwarders engaged 


with eManifest and client uptake continues to 
increase 


Y Multiple rounds of training for BSOs have 
been delivered and an effective regional 
support network is in place 


¥ Webinars, Web content, presentations 


Air ir and Mari ine Conveyance Arrivals 
№ lani ifest Forward 
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e eManifest has implemented the recommended Gartner governance structure: : 
~ Decision making is streamlined and better aligned with appropriate levels and 
— Project Authority and TIPP govern high likelihood risks | 
— Project Authority decides majority of governance related issues 
— Significantly enhances project efficiency 
— A Change Management Process has been fully established. 


e  eManifest has implemented more rigorous reporting: 
— eManifest TBS Dashboard and 
— eManifest Monthly Earned Value Report. 


e Fully resource loaded schedules have been developed: 
— Allows for improved clarity on percentage of work complete; 
— Supports financial tracking, tasks authorization management, earned value based status 
reporting; and 
— Informs the project cost base. 
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Project Support & Control Project Support & Control PSCO & eManifest Project Enterprise Project 
Office (PSCO) Office (PSCO) Managers/Executives Management Office 


Schedule & Oversight & Governance 
Financial Monitoring Consolidation — Project Integration Board | | 
- Weekly Schedule | - A Aggregation of financial - Weekly Leadership meetings ~ Monitoring & Control 
Monitoring and progress reports with AVP - Agency level risk 
-  Cross-reference - Project Dashboard - Bi- Weekly DG Health Check management and 
Schedule to updates - Project Advisory Committee portfolio performance 
Enterprise time - Feeds schedule & - Transformation, Innovation management 
tracking financial dashboard risk and Project Portfolio 
-  Professional/ ratings Committee 
Procurement costs - Senior Project Advisory 
Committee 
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Comp 


INTAKE 


lete the Form and Submit | 
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| Estimate Impacts | 


Emergency Change | M 
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[Submitter] 
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*Risk-Based 
Decision 
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Г Inform P 


iB 


APPROVE Appr 


INTEGRATE | Update Baseline 
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mproved fiscal responsibility: 


— Project funding have been centralized and is managed through Task 
Authorizations | oa — to each арос و‎ using eManifest 


„ЕЁ Project f fund ing 7 бег — on QA" resource loaded 
Schedules imis au app p. geme) | 


` (EPMO) ‹ are же. to ensure e n iancy with ^. Se | rej ring 
requirer een 
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The j integration of risk assessment and 


| | 
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| Capability for ! (eR ESTIS and | 


risk results eManifest Notice for TCPs | 
(Real Time Data & Automated Risk 
Assessment moves to maintenance) 
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SWI Integrated Importer Declaration 


decisions between NTCand fleld 
operations (BSOs! 
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EZE | 
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1615/16. 
Development Costs | 


IH - Core Business Information Model 
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ighway and rail modes, 
ehouse arrivals, requirements for freight 
odes and bay plan requirements іп the marine 


andatory ele 
forwarders in all mr 
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There are 14,314 active highway 
carriers through FY 14-15. 
Of the active highway carriers, 


testing and/or active, pending 
inactive or suspended in the 
eManifest Portal. 

The 8,666 carriers, represent 96% 
of all highway volumes, both 
electronic and paper, currently 
through FY 14-15. 


Rail Carriers 


11 rail carriers currently 
represent 100% of all rail 
volumes, both electronic and 
paper, through FY14-15. 

As of February 2015, eight of 
the 11 carriers are in 
production or are in testing 
eManifest. 


Á interest in 
elvianifest 
3 


ght Forwarders 


* There are 992 total registered 


freight forwarder codes as of 
February 28, 2015. 


e 319 freight forwarders are 


engaged in EDI or eManifest 
Portal registrations. 


Inactive 9 
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CBSA - Released under the Access to Information Act. 
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“Data Analytics” 


Data Analytics capability to assist intelligence officers / targeting teams in the 
National Targeting Centre (NTC) in the mining of the existing and historical 
trade data _ 


e Modification of existing indicators based on analysis / outcomes and new data 
feeds 
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v omate Ri 


? Capabili ty fc iori the NTC t to view High Risk Commodity risk results (Real Time) in 
all modes; 

e Supports the ability to target or interdict high risk shipments using legacy 
br ipee \ — | 


iem, in new г system VS. расу system 
e Validating and improving the Automated Risk Assessment results 
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Complet 


o Capabi lity fc fort the NTC & co view targets and all risk results (Real Time) in all modes 
e Capabi Шу to assess the operational порае of implementing new risk rules (using 
simulation) 
• The new notices provide desirable functionality to help improve communication between 
CBSA and its clients as well as business-to-business communication. 
° Validation of the Risk Assessment Model (identification of low and high risk entities) 


e Validation that the planned targeting work force can handle the volume 


000387 


20 I Decision Model" 


‘int — d 


Complete пїеагайоп of SK assessment and passage decisions between NTC and field 
operations Border Services Offic cers a 

Advance Trade Data (АТО) i in all bua i D. Вы 9 bre tam -— provides clarity on 
what commodities are being imported by whom 

Fully integrated commercial processing system and application, includes SWI 

New Documents and Notices available to external clients 

The eManifest system becomes the new system of record 


Full Benefits Realized for TCPs (Manifest Forward, Streamlined Border Processing) 
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CBSA - Released under the Access to Information Act. 
i ion en vertu de la loi sur l'Accès a l'information 


Canada Border Agence des services 


Services Agency frontaliers du Canada 


December 201 
Commercial Projects Directorate, ISTB 
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e eManifest Benefi 
Proj Update А 
Deployment 2B (Data Analytics) 
— Deployment 4A (Notices) 
Deployment 4B (Risk Assessment Program Maintenance) 


e Implementation Strategy 
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Creation of the 
Entity model for 
all shipments 

e100% of 
commercial 
shipments, 
across all modes, 
are risk assessed 
prior to arrival. 
Automated 
threat-based risk 
determinations 
will be used to 
identify high and 
unknown risk. 
Low risk 

| shipments will be 

, automatically 

| released. 


*Hisk assessment | 
results and | 
examinations are 
used to "close the | 
loop", revise risk — 
assessment rules 
and continually 
improve the risk 
assessment 
process. 


ePre-arrival risk 
assessment 
completed on all 
commercial 
shipments in all 
modes (air, 
marine, rail and 
highway) 

*New application 

with a user 

friendly Graphical 

User Interface 

(GUI) 


notices for Trade 
Chain Partners | 
Introduction of j 
Advance Trade 
Data (ATD) from 
Importers 
Introduction of 
Multi-Modal 
Cargo document 
eSelf Service 
portal 
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ror Trade 
k 


All Trade Chain Partners electronically 
transmit advance commercial 
information, which can be used in 
communication with other trade chain 
partners . 


Risk assessment prior to arrival 
provides consistency to trade. 


Standardization of the commercial 
process with the expansion of 
automated risk assessment to alll 
modes. 


targeting and inspection facilitates the 
legitimate flow of low-risk trade. 


Ability to cleanse data reduces costly 


Trade. 


continually improve the risk assessment 


Data Acquisition - All trade chain partners 
transmit data electronically prior to arrival 
from all modes. 


Entity Model — Pre-arrival trade data from 
muitiple documents is compiled into | 
“entities” that provide a complete view of the 
shipment, conveyance, and equipment. Risk 
assessment happens at the entity level 
rather than on individual trade documents. 


Automated Risk Assessment - Commercial 
entities, across all modes, are risk assessed 
prior to arrival. Threat-based risk 
determinations will be used to flag high and 
unknown risk entities to the targeting 
officers. Low risk shipments will be 
authorized to move inland or released by 
the system. 


Integrated Targeting Model — Risk 
assessment for admissibility and release 
decisions in all four modes is done by 
targeting officers at the National Targeting 
Centre. 

Business Intelligence — Risk assessment 
results and examinations are used to "close 
the loop", revise risk assessment rules and 
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systems Deployed: 


* SEN S XN NN 


AC! Air & 
Marine 


Deployment of eManifest Functionality in Production 


Date Acquisition 
‚ for Freight Forwarders 


Web Portal 
for Highway 


Dato Warehouse & 
Analytics Phase 1 


Data Acquisition 
for Highway 


Data Acquisition 
for Rail 


Core information 


Phoenix; 
Business Model 7 


eManifest Portal ¥ Highwa 
Air and Marine Conveyance Arrivals V Rail Reporting 
Manifest Forward Y Freight Forwarder Reporti 
Data Warehouse 

Core Information Business Model 

ata Analytics 


Phoenix 
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EI DW) noit lance Pun 
supporting c data a anal cs to demonstrate ше business value of moving 


D2A data 
BIM and Commodi ity Ris! 
e: un 29, 2015. 
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ıented in March 2015. 


_ This was the start of Automated Risk Assessment and introduced the risk 


results User Interface (UI) that supports the viewing of shipments. 


D3 provided the ability to view and modi 


ity High Risk Commodity rules and 
the capability for the NTC to view High Risk Commodity risk results (Real 
Time) in all modes. 


In addition, it supports the ability to target or interdict high risk shipments 
usi Ing legacy con marcia al systems and allows the Program to assess the 
perfor : Risk Commodi ty rules in new system vs. legacy 

the Automated Risk Assessment results. 


" ш, кайдай oi and | improving t 
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In January 2016, the CBSA ced 
notification Systems | to increase autora Ion of pre- -and | bost-s arriva 
notices to clients on commercial movements. 


e The new eManifest notices were designed through consultations with 
external stakeholders and will provide insight into the “disposition” of their 


shipments. 


New eManifest notic ices will advis Ise on the completeness of advance data 
submitted to the CBSA and on the arrival and release statuses of 
shipments. 


e The notices align with the me 


ssage that stakeholders receive from US CBP. 
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e Replaces existing targeting functionality in ACR 
for production in April 2016. 


— Commercial Analysts create medium-complexity targets on behalf of other 
government departments 


x 


e 500+ targetable elements and flexible operators enable creation of virtually any 
rule imaginable. 
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e Complete | oo on of Пак assessment and pesaga decisi ions between 
NTC and field RGO 


nhance | | 
results. 


D) in all modes supports Targeting Program, 
niin clarity on what commodities are being imported by whom. 


SR 


Fully integrated commercial 
Single Window Initiative. 


processing system and application, includes 
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e The scope of D6A is to provide Risk A 
Management Reports. 


ssessment: Operational and 


is to provide Passage: Operational and Management 


e This will allow for Program Performance and Operational 
increased Decision Support for Programs. 


production): April 2016 


Production): December 2016 
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2015, to January 10, 2016, carriers who do not comply with 
est requirements may be issued zero-rated penalties (non-monetary) 


Beginning January 11, 2016, carriers who do not comply with eManifest 
requirements may be issued monetary AMPS penalties and will experience 
processing delays. 


Forwarders continue to be in a voluntary compliance period. Once 
4A is in production and all system functions are available to electronically 
process consolidated imports, regulations will be enforced. 


انين 


ely with carriers and freight forwarders on 


corrective | nts. 


jeasures to help them comply with eManifest requireme 
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‘Data Anal tics” 


e Data Analytics capability to assist intelli igence officers / targeting teams in the 
National Targeting Centre (NTC) in the mining of the existi ing and historical 
trade data a 


D. 2 n fw | EX WA А: Bx E М. y ES 22 ER 12 Se 3 23 E IS L9 dE É v QA 


e Capability for the NTC to assess risk based on historical trend analysis (e.g. 
anomalies in a companies Business Profile — pattern and trend deviation) 

e Identification of ‘candidate’ risk indicators (e.g. use analytics to develop new 
rules based on vessel routing patterns, container delivery address) 

e Modification of existing indicators based on analysis / outcomes and new data 
feeds 
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‘Commodity Н Risk k Assessmen a 


ə Capabili iy fc ior the NTC t to view High R 
all modes; 

e Supports the ability to target or interdict high risk shipments using legacy 
commercial systems 

e Ability for the Program to assess the performance of High Risk Commodity 
rules in new system vs. legacy system 

e Validating and improving the Automated Risk Assessment results 
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mplete Automated Risk Assessment (all risk rules are executing and vie 


e Implementation of initial eManifest new notices for Trade Chain Partner 
ا‎ ed Import D 


TCt 


e Тһе new notices provide desirable functionality to help improve communication between 
CBSA and its clients as well as business-to-business communication. 

e Validation of the Risk Assessment Model (identification of low and high risk entities) 

e Validation that the planned targeting work force can handle the volume 
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Decision 


"Integrated L Model” 


Complète stone of isk assessment and passage decisions between NTC and field 


operations Border Services Officers (BSOs) 

Enhance Program integrity through “closing the loop” on examination results 

Advance Trade Data (ATD) in all modes supports Targeting Program — didi dd clarity on 
what commodities are being imported by whom 

Fully integrated commercial processing system and application, includes SWI 

New Documents and Notices available to external clients 

ids d =. ا‎ the ı new phe? wi of record 
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F nc ice апа Орогайопа! Re 
e moreaseg Decision Support for Programs 
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© | BSA 

;'ommercial business model, specifically the commercial risk assessment 
process. Strong change management will ensure that the people, 
organization and cultural impacts are addressed in a structured and proactive 
manner. 


e Тһе eManifest Stakeholder Engagement and Communications Strategy 
guides continuing project communications to internal and external 
stakeholders. 


e The external strategy is targeted for each trade group and focuses on the 


different set of functions available within a release. 


X | ж 


e The end state will have more impacts оп the internal stakeholders, as such, 
n internal communication strategy will be developed to include key 
messages for the different end users within CBSA. 
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e Strategy and training modules for end 
consultation with 
be dependant on deployment option selected. 


e Training strategy includes the transition of the training into the core BSO 


Commercial Training program. 


es. Delivery of training will 


Systems 
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Phoenix RAPM Passage 


Help Desk 
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6 deployment options were identified, each of which was evaluated using 12 


ria with the goal of understanding the relative risks and benefits of each 


Dai p "e CS m move to the National Targetin 
2015. 
Funding 


The D 
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Canada Border Agence des services 
Services Agency frontaliers du Canada 


November 28, 2014 


E rieting to the Senior Project Advisory 
Committee by the Commercial Projects 
Directorate 
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8 gs 
“y 2g ЗСУ" 


"us s 


ng with Comptrollership and TB for briefing scheduled December 
11%, 

— Monthly reporting to TBS on Executive Dashboard and monthly 

Project Management Office. 

— Working with Comptrollership and PWGSC on amendments to existing 
supply arrangements to cover project timelines. 


Structure. 
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The integration of risk assessment and 
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: operations (BSOs) 
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Cumulative percentage of Business 


| | Performance and Operational Reporting 
Functionality across Deplayments 


time pattern & trending data through queries 


CBSA - ions under the Access to Information Act. 
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Identification of shipments of interests based on Intelligence received from 
the National Targeting Centre (NTC). 


Analytical tools that seek business pattern deviations based on known 
characteristics of a companies importing history. 


Analytical tool to assist targeting operations in identifying illegal 
precursor chemicals. ۴ 


Assesses pre-arrival commercial data and assists in identifying shipments o 


interest in the rail environment. 
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. ments on nof Y High Ri ki S modity 


e Supphrts thie ability to tant or interdict high risk shipments using legacy commercial 
systems 

e Ability for the Operations to assess the performance of High Risk Commodity rules in 
new system vs. legacy system 

e Validating and improving the Automated Risk Assessment results - 
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Ministers briefing. 


endments for professional services. 


e Committee 


meeting December 5'^ 


Deployment 3. 


* 


roject Sponsors in 


Deployment 3 functionality to P 


January 2015. 
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Walton, Carole 


From: Allison, Melanie 

Sent: May 13, 2016 10:56 AM 

To: Popova, Diana; Laplante, Francois; Custance, Carla; Fisher, Melanie; Paquette, Isabelle; 
Beiersdorfer, Barbara; Stewart, Nancy (CBSA); Lane, June 

Subject: FW: E-manifest stories 


Very good email that describes the targeting benefits that eManifest has brought to date for the Agency. 


From: Mosca, Matt 

Sent: May 9, 2016 2:52 PM 

To: Allison, Melanie; Bratanic, Margarita; Hotchkiss, David; Breakwell, Candace-Ann; Rice, Geoff; Uchman, Darren; 
Laquerre, Brenda 

Subject: FW: E-manifest stories 


Hey all — as discussed at PID this am, below are some beneficial eMan stories 
Thanks, 


Matt Mosca 


A/lunior Program Officer 

information, Science and Technology Branch 

Canada Border Services Agency / Government of Canada 

Matt. Mosca Q cbsa-asfc.gc.ca / Tel: 343-291-6181 / TTY: 866-335-3237 


Agent subalterne de programme p.i. 

Direction générale de l'information, des sciences et de la technologie 
Agence des services frontaliers du Canada / Gouvernement du Canada 
Matt.Mosca@cbsa-asfc.gc.ca / Tél: 343-291-6181 / ATS: 866-335-3237 


From: Leahy, Mike (CBSA) 

Sent: May 6, 2016 8:18 AM 

To: Scotten, Michael; Soloway, Su; Clarida-Borger, Ruth 
Subject: FW: E-manifest stories 


Fyi 

From: Imrie, Megan 

Sent: Thursday, May 5, 2016 3:39 PM 
To: Walker, Christine (HQ) 


Cc: Blanchard, NathalieX; Porrior, Paul; Sovani, Zaina; Pinsent, John; Xavier, Caroline; Bolduc, Martin; Chénier, Maurice 
Subject: E-manifest stories 


Hi Christine, 


As requested, please find input from Operations (thanks Paul!) and Programs in advance of the meeting with 
Finance. Probably more than you need, but we thought you could pick and choose the most compelling 
points. 
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E-Manifest - Analytics enhancing operational decision making: 


e Enterprise Data Warehouse — eManifest has enabled an enhanced enterprise data warehouse, with 6+ years of 
data, providing a 24-hour refresh. This has enabled the NTC to enhance decision making through analytics in 
real time for Marine Cargo and Conveyance. Later this year eManifest will be providing a 1-hour refresh of data, 
which will enable the NTC to enhance decision making in Rail, Highway and Air. 


e Supporting Risk Rule Development – The NTC is using the Enterprise Data Warehouse to conduct research and 
analysis in order to develop, monitor and improve Risk Indicators for Commercial. This supports targeting at the 
NTC and the creation and development of new risk indicators, which in turn helps in the identification of high 
risk goods. 


e Advance Commercial Information: Prior to eManifest the Agency did not have an automated means to collect 
Advance Information and target in the Highway and Rail modes. The implementation of eManifest has obligated 
the provision of Advance Commercial Information by Highway and Rail carriers. New mandatory eManifest 
requirements of Conveyance Arrival Certification Message and Warehouse Arrival Certification Message now 
also provide the agency situational awareness on the movement of targeted goods. 


CN and CP are in full compliance and represent 9596 of rail volumes into Canada 
Highway carriers now provide mandatory Advance Commercial Information and have a high level of 
compliance. 

o Ву bringing these two modes online, along with marine (2004) and air (2006), we are much closer 
towards paperless processing of the over $1 M worth of imports that arrive into Canada each minute 
while better being able to identify threats to the health, safety and security of Canadians pre-arrival. 


e Business Information Search — eManifest analytics has enabled the NTC to build models that allow intelligence 
and targeting officers to search for specific company's addresses or phone numbers in a matter of seconds. This 
process previously took days to execute. 


e Business Profiles – The NTC analytics team has developed processes to identify normal and abnormal 
behavioural patterns for specific businesses operating in Canada. This stream allows the NTC to determine if 
shipments related to these businesses is of low, medium or high risk. 


e Commodity Profiles – The NTC analytics team has developed processes to identify normal and abnormal 
behavioural patterns for specific commodities being imported into Canada. These streams allow the NTC to 
determine if imported commodities are of low, medium, or high risk. 


e Predictive Analytics (Further results below) — The NTC has developed predictive models that have been 
operationalized at the NTC to identify high risk goods destined for Canada. Success from these processes will be 


incorporated into the Risk Indicators build developed for automated targeting in eManifest. One specific model 
resulted in the largest cocaine seizure of last fiscal year, and also led to multiple arrests. After only 6 referrals, 
the predictive model built by the NTC identified this specific shipment for referral, which was enabled by 
eManifest and the enhancement of the Enterprise Data Warehouse. 


e Vessel Reporting — The NTC analytics team has developed a report that aids targeting officers in triaging their 
work lists. The report summarizes important data (including historical trade chain partner data, and previous 
exam referral data) in a way that is currently impossible in any other system and this was enabled by the 
eManifest project. 
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e Enforcement & Intelligence — The NTC analytics team works closely with the Intelligence analytics team to 
provide expertise on building analytical queries to create efficiencies and identify high-risk commercial entities. 


e Operational Decision Management (ODM) – The ODM risk rule development and maintenance software 


application permits the Targeting Risk Indicators and Scenarios team has enabled the CBSA to : 


e Develop, analyse, create, build, enter, activate, monitor and maintaining commercial risk indicators to be 
used with the new eManifest systems and functionality being delivered. 


Significant CBSA Contraband Interdictions 


Provided below are a number of significant interdictions identified by the CBSA National Targeting Centre (NTC) through 
the direct application of E-manifest enabled advanced analytics. The NTC employs data analytics software to assist in 
the linking and analysis of data received from various sources (domestic and international partners, past seizures, high 
side intelligence). This transcends into the creation of Risk Assessment Targets, Intelligence Reports, Shift Briefings, 


targeting projects and successful interdictions. 


Air Mode 


Marine Mode 
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From: Bolduc, Martin 

Sent: May 4, 2016 5:11 PM 

To: Chénier, Maurice; Walker, Christine (HQ); Xavier, Caroline; Imrie, Megan 
Cc: Blanchard, NathalieX 

Subject: Re: E-manifest stories 


Megan who is copied will reach out to Ops 


De: Chénier, Maurice 

Envoye: mercredi 4 mai 2016 16:20 

A: Walker, Christine (HQ); Bolduc, Martin 
Objet: RE: E-manifest stories 


OK ~ Martin : just to make sure this doesn’t fall into any cracks ~ are you chasing down with OPS on this one? 


Thanks 


From: Walker, Christine (HQ) 

Sent: May 4, 2016 4:19 PM 

To: Chénier, Maurice; Bolduc, Martin 
Subject: E-manifest stories 


For the e-man tb sub | need specific examples of how e-manifest allowed us to target and find illicit goods. 


| need by Friday AM - 10 stories which Michael Vandergrift could use to present to TB to show the impact of 
this system. 


Sent from my BlackBerry 10 smartphone on the Rogers network. 
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eManifest 


eManifest modernizes and enhances the screening 

of goods and commercial processes by improving 

the CBSA's ability to detect shipments that pose a 
high or unknown risk prior to their arrival and 


facilitating the movement of low-risk shipments. 
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eManifest Benefits - Canada 
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“eManfiest Benefits - Canada’ slide 


Key messages: 


e eManifest will receive the right information from the right source at the right time. 


e Using this advance information up front, enables the Agency from a systems 
perspective, "to see the risks" . 


e We сап use this data to determine: 
Who is Who? 
Who knows Who? 
What are the goods? 
Is there a known risk? 


e And thereafter build profiles and historically compare otherwise disparate data 
groupings. 
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eManifest Benefits - Trade 
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“eManfiest Benefits — Trade” slide 


Key messages: 


* Prior to eManifest there is no requirement for importers to provide information 
about the goods prior to arrival, so this information can only be used when 
available. 


* This advance data provides more detailed information about the goods and 
enables greater exposure into the supply chain. 


* When all trade chain partners provide data, entity relationships and linkages can 
be established. Trade can use their data, for example by electronically share 
notices and electronic documents , i.e. manifest forward in order to facilitate 
import movements. For example a carrier can electronically share their cargo and 
conveyance data with a broker who can prepare release documentation. 
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eManifest Benefits - CBSA 
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“eManifest Benefits — CBSA” slide 


Key Messages: 


e Our organization, CBSA, and our mandate, will significantly benefit from the 
investments that are being made as a result of eManifest, particularly in the risk 
assessment continuum. 


e When all trade partners are transmitting, we will have predictability, we will have 
insight into their organizations, we will be able to analyze, learn and build the 
capacity of our risk assessment systems. 


e We will see risks in advance. 
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“eManifest Accomplishments’, slide 


Key messages: 


e Building upon ACI - Air and Marine, the eManifest project has made significant 
achievements in moving the project forward. 


e The focus of the project in the beginning was to engage our trade chain partners 
and put in place the IT infrastructure investments and pieces so that we have the 
ability and capacity to receive the mandated data. 


e Some of the highlights include: 


e Since fall of 2009 we have been able to receive data from highway carriers and to 
date of the 8,600 carriers who are engaged with eManifest represents 
approximately 96% of our highway volumes. 


e During this time we also designed, developed and implemented the eManifest 
Portal, a free option for certain trade chain partners to use to efficiently send their 
cargo and conveyance data to the CBSA. 


e During 2012 we worked closely with the rail community and are receiving data 
from the major rail carriers. 


o Early in 2013, the project worked closely with the regions through the chiefs 
working group to implement the eManifest regional external client support 
(eRECS). This service has been very welcomed and appreciated by the trade 
community as well as within the project itself. As well we have supported the 
region by delivering training based on operations needs. 


* More recently the project has been focused on building our data warehouse that 
will support the risk assessment systems being developed. 
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"eManifest Process Flow “ slide: 
Key messages: 


The project has been focused on 4 primary areas, Data Acquisition, Risk 
Assessment, Passage, and Business Intelligence 


* Full benefits realized for TCPs with electronic submissions, notifications, 
streamlined border processing and consistent national approach. 


* Full benefits realized for internal stakeholders with an automated risk assessment 
process, improved commercial business process with risk assessment on all data 
from all modes, streamlined examination results and better tools/applications for 
our Targeting Officers and front line officers. 


* New Commercial border processing application (Passage) that will be used by 
BSOs to process commercial shipments as they enter Canada 


* eManifest systems becomes the new systems of record and there is full 
integration between the POEs and the NTC, with enhanced program integrity 
through "closing the loop" on examination results. 
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"Data Acquisition — All trade entities" 


Key Messages: 


e Documentation (ATD/PARS/RMD/IID, Cargo, Conveyance, Supplementary, 
Housebills) is received from the Trade Chain Partners (TCPs), merged into an 
‘entity’ within the system and presented to the Targeting Officer as a holistic view 
of the shipment 


* When data is received, cleansing tools will be used to improve the quality of data 
presented to the officer and will reduce costly requests for information (RFI) to the 
Trade. (Addresses, identities) 


* Clusters of the best quality data are pulled from multiple trade documents and 
organized into 'entities' for risk assessment (shipment, conveyance and 
equipment). 


* Single user can assess trade information from all TCPs (ACI data and commercial 
release) and make an admissibility and release decision against the ‘entity.’ 
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Key Messages 


The changes with the Passage system will allow the BSO to focus on their Core 


Mandate — Examination and evaluating high risk at the border 
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eManifest Process Flow 
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Examination Results 


"eManifest Process Flow" slide 


This slide represents and summarizes the 4 main areas that have been described on 
the previous slides and visually represents the operational business flow of the data at 
stages before, during , and after the border. 
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eManifest Training 


personnel are trained to use the new systems. 


* The Commercial Projects Directorate's Project Training Unit is 
developing and delivering training material for impacted CBSA end- 
users. 


* A wide range of training products and activities will be delivered 
according to operational impacts and the complexity of the 
functionality, processes, and policies involved. 


* Regional eManifest resources will be used to validate and make 
recommendations on training products 


"eManifest Training" slide 


Key Messages: 


The project has and continues to work closely with Operations and Program areas to 
support BSOs with the knowledge of how to process eManifest shipments 


* [he CBSA is implementing operational training activities to help employees acquire 
knowledge and skills required to use the new systems and processes implemented 
by eManifest . 


* This will be done in consultation and collaboration with the Training and 
Development Directorate, Commercial Operations, Commercial Programs, the 
Chiefs Working Group, and eRECS personnel 
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“National Targeting Centre (NTC) Training” slide 


* This slide provides a high level overview of the training strategy for the National 
Targeting Centre 


* Training on the two primary eManifest systems: Phoenix, RAPM 


e Various Training methods will be used and post-training support will be provided to 
the users. 


Additional details: 


Training Summary: 
RAPM (Risk Assessment Program Maintenance) 


~350 end-users - National Targeting Centre (NTC) Targeting Officers and 
Superintendents, Commercial Analysts, and HQ end-users 


Training duration: ~Up to 1 day of training per end-user. 

Phoenix 

~150-200 end-users - NTC Targeting Officers and Superintendents, and HQ users 
Training duration - ~Up to 2 days of training per end-user. 


Post training support will be as-required based on observations during training, training 
evaluations, and feedback from end-users. 
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Regional Training” slide 


Key Messages: 


* This slide provides a high level overview of the training strategy for the employees in the 
regions 


* Training on the two primary eManifest systems: RAPM for regional intelligence and 
Passage for POE personnel. 


e Various Training methods will be used and post-training support will be provided to the 
users. 


e Our next steps with training include: 


o In the coming weeks and months, we will consult with the Regions , Commercial 
Programs, Commercial Operations, and the Chief Working Group to ensure 
effective operational planning for training 


o For our design and development of training we will be collaborating with TDD 
Additional Details: 
Passage 


~5000 end-users - BSOs, Superintendents, Clerks in all modes, and HQ users 
Training duration - ~ Up to 3 days of training per end-user. 
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Benefits of eManifest 
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Trade Chain partners electronically transmit А 


advanced commercial information. 


Automated risk assessment is expanded ta 
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rai 


Enhanced risk assessment allows for the 
dynamic creation of automated risk rules 
across 8 threat categories. 


Focus on high risk shipments for targeting 
and inspection. 


Better quality data will reduce costi 
requests for information (RFT) to the Trade. 


Facilitates the legitimate flow of low-risk 
trade. 


Lowers the overall cast of reviewing 
shipments 


Data сз All trade chain partners 
а data electronically prior to arrival from alll 
modes 


Entity Model ~ Pre-arrival trade data from 

multiple documents is compiled inte "entities" 

that provide a complete view of the shipment, 

conveyance, and equipment, Risk assessment 

bons pens at the entity level rather than on 
ividual trade documents. 


Automated Risk Assessment - 10076 of 
commercial shipments, across all modes, are risk 
assessed prior to arrival. Automated threat- 
based risk determinations will be used to identify 
high and unknown risk. Low risk shipments will 
be automatically released. 


Integrated Targeting Model ~ Risk assessment 
for admissibility and release decisions in all four 
modes is done by targeting officers at the NTC. 


Business intelligence ~ Risk assessment 
results and examinations are PA to “close the 
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| "HUE loop”, revise risk assessment rules and 
Standardizes the commercial risk continually improve the risk assessment process. 


assessment process. 


The current reliance on paper documentation is burdensome and not easily used 
for risk assessment 


Information from various sources at different times leads to an incomplete 
picture of the whole shipment 

Insufficient regulations on information required from trade to ensure proper 
security at the border 

Aging systems with limited functionality, which takes time for officers to 
process at the border 

Uncertainty for trade about status of processing of their shipments at the 
border 


After eManifest 


100% Electronic documentation for more comprehensive information 
regarding risk decision-making 

ohipment information from all sources linked to see the whole picture of an 
Importation 

New regulations will ensure the Agency has the necessary information to 
make informed decisions 

New user-friendly systems that will facilitate informed and efficient decision 
making at the border 

Improved two-way electronic messaging with trade that will help all TCPs 
share information on shipment status throughout the process 
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shipment status 

— Spring 2016, National Targeting Centre will be able to view 
targets and risk assessment results (Deployment 4) 

— Winter 2016/2017, National Targeting Centre is able to make risk 
assessment decisions. Implementation and training activities will 
thereafter follow allowing shipments to be processed at CBSA 
Offices using the Passage application. 


* Working with the Programs and Operations Branch to communicate 
process pertaining to regulatory compliance. 


"Next Steps" slide 


Key Messages: 
e The project is focussed on implementing significant releases. 


* Programs, Operations, an IST Branches are working together on communicating 
regulatory compliance timelines. 


e |n the coming weeks and months, we will consult with the Regions , Commercial 
Programs, Commercial Operations, and the Chief Working Group to ensure effective 
operational planning for training 


Compliance Timelines as per the CBSA website: 


On May 6, 2015, regulatory amendments supporting the eManifest initiative 
were published in the Canada Gazette, Part Il. eManifest requirements for 
highway carriers are now mandatory and the Agency is working with carriers on 
corrective measures to help them comply with requirements. The following 
implementation timelines apply: 


From July 10, 2015, to January 10, 2016, carriers who do not comply with 
eManifest requirements may be issued zero-rated penalties (non-monetary) 
under the CBSA'5s Administrative Monetary Penalty System (AMPS). 


‘Beginning January 11, 2016, carriers who do not comply with eManifest 
requirements may be issued monetary AMPS penalties. 


Additional information communicated by Customs Notice 15-030 "Interim eManifest 
Requirements Respecting Empty Highway and Rail Conveyances and In-transit 
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| Version Control 


April 15, 2013 
April 17, 2013 
Comments 


Recommendations from ATIP May 7, 2013 


Changes Based on ATIP’s and May 8, 2013 
Privacy Consultant’s 
recommendations 


Group Feedback 

Changes based on Privacy June 24, 2013 
Consultant feedback and Final 

PIA Working Group Feedback 

Small wording changes and July 11th, 2013 
added text to details for question 


13.1 based on manager feedback. 


Updated based on ATIP’s final August 2, 2013 
feedback 


Updated based on Legal August 7, 2013 
Service’s comments and final 

review. 

Amended to include the addition | May 15, 2014 
of CDEM and AVI that will be 

used to support Risk Assessment 

in Build 2 as well as the 

operational use of the data 

warehouse. 
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Canada Border Services Agency (CBSA) 


CBSA IST 002 


CBSA PPU 048 


Vice President, Programs Branch 
ATI and Privacy Director 


| EXECUTIVE SUMMARY 


eManifest Build 1 


 eManifest is the third phase of the Advance Commercial Information (ACI) program, which mandates 
the submission of electronic pre-arrival commercial information, increasing the Canada Border 
Services Agency's (CBSA) ability to perform an effective risk assessment prior to the commercial 

| goods arriving in Canada. The ACI program is about getting the right information at the right time to 
enhance the CBSA's ability to identify potential threats to Canada, while facilitating the movement of 
low-risk commercial goods across the border. 


The CBSA successfully implemented Phase I (Marine mode) and Phase II (Air mode) of the ACI 

| program in April 2004 and June 2006 respectively. Phase Ш of the ACI initiative, eManifest, extends 
the requirements of ACI Phases I and II to the highway and rail modes. Furthermore, once fully 

| implemented, eManifest will require commercial carriers, freight forwarders and importers or their 
brokers in all modes of transportation (air, marine, highway and rail) to electronically transmit pre- 
arrival cargo, conveyance, house bill/supplementary cargo and importer advanced trade data to the 
CBSA, as well as crew information. 


eManifest will be implemented in three builds as follows: 


e Build І includes electronic pre-arrival submission of cargo and conveyance information in the 
highway mode (implemented October 2010), rail mode (implemented May 2012) and house 
bills in all modes (implemented in June 2013), and the introduction of the eManifest Portal 
advanced information transmission method and enhanced notification processes (August 201 1); ! 


e Build 2, which will be implemented at a future date, will include the optional electronic pre- 
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arrival submission of importer data (advance trade and release data) and will introduce an 
enhanced automated risk assessment system for transmitted importer, cargo, conveyance, and 
house bill information in all modes; and 


e Build 3, which will be implemented at a future date, will include the submission and 
subsequent risk assessment of electronic pre-arrival crew information in all modes and 
enhanced functionalities for risk assessment. 


Тһе CBSA has developed an implementation strategy for eManifest where participation will be 

| voluntary for the first year following each implementation date to allow clients time to prepare for 
mandatory program requirements. This will be followed by a 6 month informed compliance period 
where only zero-rated penalties will be applied, at the end of which participation will be mandatory. 


| This Privacy Impact Assessment (PIA) is specific to Build 1 of eManifest. Separate PIAs will be 
completed for each of the subsequent builds, as they include additional personal information elements 
and may include additional uses for the information. 


The personal information collected in Build 1 on the cargo and house bill submissions includes contact 
| information for the shipper, consignee, notify, and delivery parties, da | 
| information, as well as vehicle/equipment identification information. 


This personal information is transmitted electronically to the CBSA by a carrier, freight forwarder or 
Service provider through either Electronic Data Interchange (EDI) (all modes) or through a new 

| information transmission option, called the eManifest Portal, which allows for the electronic 
submission of pre-arrival commercial information through the Internet (house bills all modes, and 

| cargo and conveyance data in the highway mode only). Information must adhere to the following 
timeframes by mode: 


bill information in Canada 
information in Canada 


Marine house bill information Twenty-four hours prior to loading on 
the vessel at the last foreign port of 
loading depending on type and origin of 
commercial goods 

Air house bill information Four hours prior to arrival in Canada or 
at time of departure for flights less than 
4 hours in duration 
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. Carriers and freight forwarders who wish to submit information through the eManifest Portal must 
register for an account. This process begins with a cyber-authentication offered by the government of 

. Canada (outside the scope of this PIA). Then the CBSA requires Business Account owners to obtain a 
shared secret, and register for both a Portal Business Account and User Account; all three of these | 
steps require contact information to be provided. In addition, language preference is required to create _ 
a Portal User Account. Account Owners may designate other users for their account. These other 
| users only register for a Portal User Account. This contact information will not have any other use 
outside of registration, testing and client support. All Portal users are also issued a Unique Reference 

. Number (URN) for identification purposes. 


| similarly, carriers and freight forwarders wishing to submit information through EDI must provide 
contact information as part of the registration process. This information will only be used for 
registration, testing and client support. 


The eManifest compliance management framework provides for client support plans and compliance 
management plans which include communications, outreach activities, policy and technical support 
helpdesks and compliance management activities which are all designed to educate clients and 

| promote compliance. 


| The CBSA is implementing the following to enhance the privacy protections of the personal 
information collected for eManifest Build 1: 


e Registering a personal information bank (PIB) for eManifest with Treasury Board of Canada 
Secretariat (TBS) for publication in Info Source; 


e Restricting the use of trade document personal information to risk assessment, admissibility, 
business analytics, compliance monitoring and client support; 


e Restricting the use of registration personal information to registration, testing and client 
support; and 


e Controlling access to the databases containing the personal information. 
Right of Access 


Ап individual will be informed of the purposes, uses, disclosure and retention of his/her personal 
information through a Privacy Notice Statement (PNS). Portal clients will view and accept this PNS in 
the Terms and Conditions every time they log on to the Portal. This PNS will also be included in the 
| paper registration process required for EDI clients. 


Ап individual may formally request access to his/her personal information, or access to corporate | 
: records related to or created by eManifest by contacting the Access to Information and Privacy (ATIP) 
Division. More information about this can be found at: http://www.cbsa-asfc.gc.ca/agency- | 
_agence/reports-rapports/pia-efvp/atip-aiprp/menu-eng.html. 
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| Accountability 


Ifan individual has concerns about the collection, use, disclosure or retention of his/her personal | 
| information, he/she may issue a complaint to CBSA ATIP. Complaints should be made in writing, and. 
include the individual's name, contact information, and a brief description of his/her concerns. 

. Contact information for the Access to Information and Privacy Division at the CBSA can be found at 
 http://www.cbsa-asfc.gc.ca/agency-agence/reports-rapports/pia-efvp/atip-aiprp/contact-eng.html. 
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| ABBREVIATIONS AND ACRONYMS 


The following is a list of abbreviations and acronyms used in this report: 


. Advance Commercial Information 


| Access to Information and Privacy 


| Canada Border Services Agency 


- Headquarters 


- Identification 


_ : Memorandum of Understanding 


| National Targeting Centre 


Office of the Privacy Commissioner of Canada 


_ Privacy Act 


Canada Border Services Agency PROTECTED B 


000543 


Canada Border Services Agency/ Advance Commercial Information / eManifest Bulld 1 - PIA 


. Treasury Board Secretariat 


Privacy Notice Statement 


: Trade Chain Partner 


| Threat and Risk Assessment 
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| DEFINITIONS 


This section provides definitions of the terms frequently used in this report: 


Action Plan ) The Action Plan describes the steps that the Program will take to address 
_ | risks that have been identified by the ATIP Division, the Office of the 
| Privacy Commissioner (OPC) and TBS. 


- Accelerated Commercial Release Operations Support System (ACROSS) - A 
 mainframe system that is used to validate and store TCP data and generate | 
notices. It is also used to review and record admissibility decisions. 


Administrative The Privacy Act defines an “administrative purpose" to be the use of an 
purpose | individual's personal information in a decision-making process that directly 
' affects that individual. 

Administrative The Administrative Monetary Penalty System (AMPS) is a civil penalty 
Monetary Penalty regime that encourages compliance with CBSA administered legislation 
System through the application of monetary penalties. An AMP applies to 


contraventions of the Customs Act, the Customs Tariff, and their regulations, _ 
_as well as contraventions of the terms and conditions of licensing agreements - 
and undertakings. The CBSA will use an AMPS to impose monetary 
| penalties in proportion to the type, frequency, and severity of the infraction. 

. Most penalties are graduated and will take the compliance history of the | 
client into consideration. An AMP does not affect businesses that continue to 
comply with CBSA requirements and regulations. 


Carrier Code А carrier code is a four character unique identifier that is assigned by the 
" _CBSA to identify a carrier approved by the CBSA. 


| Confidentiality А characteristic applied to information to signify that it can only be disclosed - 
te authorized individuals to prevent injury to national or other interests. — — 
) Cargo | Commercial goods transported in any mode of transportation, detailed on a 

: cargo control document, with a dedicated unique cargo control number. 

Cargo Control | CBSA mandates that the information on all cargo/shipments being carried 
Document | into or exported from Canada by a Commercial Carrier be reported on a 


document (electronic or paper) with a CBSA specified format. This 
document is called a cargo control document. It is also referred to as a cargo 
manifest and is used by the CBSA for risk assessment of the cargo and 
carrier and controlling the movement of the cargo. 


[sa use that has a reasonable and direct connection to the original purpose(s) 
for which the information was obtained or compiled. This means that the 
original purpose and the proposed purpose are so closely related that the | 
individual would expect that the information would be used for the consistent - 
: purpose, even if the use is not spelled out. | 


Conveyance Any vehicle, aircraft or water-borne craft or any other contrivance that is 
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Data Matching |. A comparison of personal data obtained from a variety of sources, including 
| personal information banks, for the purpose of making decisions about the 

| individuals to whom the data pertains. Data matching is a specialized 

| activity involving the collection, use and disclosure of personal information 
| that is subject to the various requirements of the Privacy Act. 


А Cargo Control Document (electronic or paper) submitted by a Freight 
/ Forwarder for shipments that have, or will be, deconsolidated from another 
. Cargo Control Document. 


“Importer Data - An individual or business that imports commercial goods to Canada. The 
importer is responsible for: 
| The payment of all duties and taxes to the CBSA. 
The accuracy of the information presented to the CBSA. 
Fines or penalties resulting from missing or inaccurate information. 
| Necessary import permits and special certificates needed. 
| In many cases a customs broker will act on behalf of the importer for a fee. 


“Info Source | Is a series of annual TBS publications in which government institutions are 
required to describe their institutions, program responsibilities and 
| information holdings, including Personal Information Banks (PIBs) and 
classes of personal information. The descriptions are to contain sufficient 
clarity and detail to facilitate the exercise of the right of access under the 
| Privacy Act. Data-matching activities, use of the SIN and all activities for 
which privacy impact assessments were conducted have to be cited in Info 
Source PIBs, as applicable. The Info Source publications also provide 
contact information for government institutions as well as summaries of 
court cases and statistics on access requests. 


| Personal Information Information about an identifiable individual as defined in section 3 of the - 
: Privacy Act. This definition, although lengthy, is not exhaustive, as indicated | ) 
by the introductory phrase, "including, without restricting the generality of — 
the foregoing". Information that is not specifically mentioned in the list may 
- still be included in the definition of personal information if it qualifies as 
|. "information about an identifiable individual". 


onal Information Is a description of personal information that is organized and retrievable by a | 
| person's name or by an identifying number, symbol or other particular | 
assigned only to that person. The personal information described in the 

| | personal information bank has been used, is being used, or is available for an 

_ administrative purpose and is under the control of a government institution. 


Privacy 15 the right of an individual to be left alone, to be free of unwarranted 

| intrusions. It is also the right of an individual to retain control over his or her 
| personal information and to know the uses, disclosures and whereabouts of 

| that information. 
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Trade Chain Partner - A trade chain partner includes any individual or business involved in the 
(TCP) import and export of commercial goods, and includes importer, broker, 
' carrier, freight forwarder, service provider, and any other designated agent 


| SECTION 1 - OVERVIEW AND INITIATION 


Report Objectives 


This report is a Privacy Impact Assessment (PIA) for Build 1 of the eManifest project of the 
Canada Border Services Agency (CBSA). The objectives of this PIA are: 


e to review the business processes in order to identify the flow of personal information; 

e {о analyze the collection, use, disclosure and retention of personal information; 

e to determine if there are privacy risks associated with the Build 1 of the eManifest 
project; and 

e to provide recommendations on the mitigation or elimination of the risks. 


The information presented in this report follows the Directive on Privacy Impact Assessment 
(2010.) 


The purpose of a PIA process is to ensure that privacy is considered throughout the project 
development cycle. The results of a PIA are a documented guarantee that privacy issues have 
been identified and adequately addressed. 


Government Institution: Canada Border Services Agency, (Programs Branch) 


Government Official Responsible for the Head of the government institution / Delegate 
Privacy Impact Assessment for section 10 of the Privacy Act 
Maurice Chénier, Vice-President Dan Proulx, Privacy Director 


eManifest Initiative: Build 1 
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Description of Program or Activity: 


Risk Assessment 


The Risk "re t program “pushes the border out” by seeking to identify dd risk рр good: - 


potenti: y Е 1 the security and safety of people and goods. 


Targeting 

The Targeting Program identifies people and goods bound for Canada that may pose a threat to the 
security and safety of the country. The CBSA uses a number of automated advance information 
Sources from carriers and importers to identify people, goods and conveyances that may pose a threat 
_to Canada. Advance Passenger Information and Advance Commercial Information provide the CBSA _ 
with electronic pre-arrival information on people and goods that can be used to perform risk | 
assessments in advance of their arrival in Canada. Known threats are identified when there is a match 
against an enforcement database entry. People and goods that are identified as posing a threat to 

. Canada are referred for verification and examin upon their arrival at a port of entry. 


Describes records related to eManifest. May inc ecords related to the establishment or use of 
electronic systems used to administer or manage the program including the eManifest Portal, Data 
Warehouse and Passage components. Further, the Accelerated Commercial Release Operations 
Support System (ACROSS), Business Number (BN), Canadian Police Information Centre (CPIC), 
CBSA Assessment and Revenue Management (CARM), Commodity Search Component (CSC), 
Customs Commercial System (CCS), Customs Electronic Commerce Platform (CECP), Customs 
Investigations Information Management Systems (CIIMS), Citizenship and Immigration Canada's 
Field Operations Support System (FOSS), Facility for Information Retrieval Management (FIRM), 
Integrated Customs Enforcement System (ICES), Integrated Customs System (ICS), Integrated 
Primary Inspection Line (IPIL), Intelligence Management System (IMS), Police Information Reirieval 
| tical Information Targeting Analysis and Notification System, | 
rocessing System (TEPS). 


Document Types: Customs Act, Regulations, Customs Notices, Departmental Memoranda, Threat and — 
Risk Assessment, Statement of Sensitivity, Preliminary Privacy Impact Assessment, Privacy Impact | 
Assessment and Memoranda of Understanding. 
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| ] Proposal for a New Personal Information Bank 
[X] Proposal to modify an existing Personal Information Bank - identify PIB registration number and 
current description: 


ais bank describes information that is used in support of determining the adr 
- ) 'onveyances and equipment into Canada. The personal inf 

business to business comments, place of acceptance, tractor and trailer plates, place of consolidation, 
and name, address and phone number for the shipper, consignee, consolidator, dangerous goods 
contact, notify party and delivery party. Personal registration information will include business name, - 
business type, company official name, position title, telephone number, fax number, email address, — 
address, language preference, Unique Reference Number and signature of company official. 


Class of Individuals: General public. 


Purpose: Personal information 15 used to administer the eManifest program or activity and to conduct 
risk assessment in order to predetermine admissibility of commercial goods and conveyances into : 
Canada, record the passage at the border, and ac e recommendations resulting from the risk — 
assessment process. Some personal informatioi or registering carriers and freight forwarders - 
so that CBSA systems can accept their electro . Personal information is collected under - 
the Reporting of Imported Goods Regulatio: ction 12.1 of the Customs Act. - 


PIA: Yes a PIA has been developed prior to the development of the PIB. 


Retention and Disposal Standards: Under development 
RDA Number: Under development 


Number: CBSA IST 002 


ber: CBSA PPU 048 


| | Proposed new Standard Personal Information Bank 
| | Proposal to modify an existing Standard Personal Information Bank - identify Standard PIB number 
and current description: 
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Legal Authority for Program or Activity: 
Current Authorities 
Section 12.1 Customs Act 


12.1 (1) Before the arrival of a conveyance in Canada, the owner or person in charge of a 
conveyance who is prescribed or any other prescribed person shall give the Agency 
prescribed information about the conveyance and the persons and goods on board or 
expected to be on board the conveyance. 


(2) A person who is required to provide information under subsection (1) shall hold a 
valid carrier code unless they are exempt. 


3) An application for a carrier code shall be made in the prescribed form with the 
prescribed information. 


(4) The Minister shall issue a carrier code to a person who applies for it if the application 
meets the requirements referred to in subsection (3) and the Minister is satisfied that the 
prescribed requirements and conditions for the carrier code to be issued have been met. 


(5) The Minister may, subject to the regulations, suspend, cancel or reinstate a carrier 
code. 


(6) The Minister may issue a notification to any person who provides information under 
subsection (1) to require the person to take any specified measure with respect to the 
information. 


(7) The person to whom a notification is issued shall comply with the notification. 


(8) The Governor in Council may make regulations for the purposes of this section, 
including regulations 

(a) respecting the information that must be given under subsection (1); 

(b) prescribing the persons or classes of persons who must give the information under 
subsection (1); 

(c) respecting the circumstances in which the information must be given under subsection 
(1); 

(d) respecting the time within which and the manner in which the information must be 
given under subsection (1); 

(e) regarding the requirements and conditions that are to be met before a carrier code may 
be issued; 

(f) regarding the persons or classes of persons who are exempt from holding a valid 
carrier code; and 

(g) regarding the manner and circumstances in which a carrier code may be suspended, 
cancelled or reinstated. 


Section 107.1 Customs Act 
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107.1 (1) The Minister may, under prescribed circumstances and conditions, require any 
prescribed person or prescribed class of persons to provide, or to provide access to, 
within the prescribed time and in the prescribed manner, prescribed information about 
any person on board or expected to be on board a conveyance. 


Section 7.1 Customs Act 

Obligation to provide accurate information 

7.1 Any information provided to an officer in the administration or enforcement of this 
Act, the Customs Tariff or the Special Import Measures Act or under any other Act of 
Parliament that prohibits, controls or regulates the importation or exportation of goods, 
shall be true, accurate and complete. 


Section 109.1 Customs Act 

Designated provisions 

109.1 (1) Every person who fails to comply with any provision of an Act or a regulation 
designated by the regulations made under subsection (3) is liable to a penalty of not more 
than twenty-five thousand dollars, as the Minister may direct. 
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The following regulations are also being updated: 
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Summary of the project, initiative, or change: 


eManifest Project Overview (Build 1 to Build 3) 


Purpose 

The eManifest project will harmonize trans-border commercial processes between 
Canada, the United States (U.S.) and Mexico, thereby enabling the CBSA to increase the 
security and prosperity of Canada. 


By eManifest end-state (Build 3), the CBSA will require pre-arrival, electronic receipt of 
cargo, conveyance, crew, and importer advance trade data in all modes of transportation. 
This advance information will be risk assessed using an automated system that will 
enable the Agency to make more informed decisions on whether to admit, examine or 
release the commercial goods upon arrival in Canada. As a result, resources will be 
focused on those people (in Build 3), commercial goods and conveyances posing the 
greatest risk to the security and prosperity of Canada. As an added benefit, the processing 
of commercial shipments will become more efficient. 


Through the risk assessment of electronic advance commercial information prior to the 
goods arrival in Canada, the CBSA will increase its ability to target, screen, and detect 
patterns and trends. The ability to identify and interdict potentially high-risk people 
(Build 3), commercial goods and conveyances, while expediting the processing of low- 
risk people (Build 3), commercial goods and conveyances, will be greatly enhanced as a 
result of this risk assessment process. 


Background 

In April 2000, the Canada Customs and Revenue Agency (CCRA) launched a strategy for 
the evolution of Customs Programs in a document entitled ‘Investing in the Future: The 
Customs Action Plan 2000 — 2004'. Within this document, the approach for modernizing 
the Customs Program was clarified. The approach described in the Customs Action Plan 
is founded on improved risk management principles and the recognition that all people, 
goods, and conveyances entering Canada pose differing levels of risk. The ability to 
distinguish between the people, goods, equipment and conveyances that pose an 
unknown or greater level of risk and those that pose a lower level of risk, is fundamental 
to the security and prosperity of Canadian society. 


Described within the Customs Action Plan are two initiatives that model the risk 
management platform within the Customs Commercial Process: 


e Customs Self-Assessment (CSA) is a comprehensive program that concentrates 
on streamlined processes for commercial carriers and importers; and 


e Advance Commercial Information (ACI), formerly known as Carrier Re- 
Engineering, is designed to employ risk-based, automated targeting against 
electronic carrier and commercial goods information transmitted before goods 
arrive in Canada, in order to detect high-risk goods, including contraband that 


may pose a threat to health, safety, and/or national security. 
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The CSA initiative was implemented December 3, 2001, at which time the focus shifted 
to ACI. eManifest was originally initiated by the ACI initiative under the Customs Action 
Plan and the Shared Border Accord (SBA) / Public Security Anti-Terrorism envelope. 


A phased approach has been taken in developing and implementing the ACI initiative. In 
Phase I (April 2004), the CBSA introduced regulatory requirements and systems 
functionality to support the electronic, pre-arrival receipt and risk assessment of 
commercial information from marine carriers for commercial goods imported from 
offshore and transported by marine vessels. In Phase II (December 2005), similar 
regulations and systems functionality were introduced to support receipt of commercial 
information from air carriers importing goods. In addition, the existing requirements for 
ACI Marine were expanded to include goods imported from the U.S. 


Phase III will be implemented under eManifest. eManifest will introduce the regulatory 
requirements and systems functionality to support electronic receipt and risk assessment 
of pre-arrival commercial information from highway and rail carriers, freight forwarders, 
importers, and brokers. 


Overall Project Scope 
A graduated multi-phased approach has been taken in the development and 


implementation of the eManifest project. The eManifest project consists of three Builds, 
which are as follows: 


e Build | components, which have already been implemented 

o eManifest Portal & Portal Administration Application 

o Commercial cargo, conveyance and house bills information transmitted 
via the Portal 

o Commercial cargo, conveyance and house bills information transmitted 
via Electronic Data Interchange (EDI) 

o Commercial Document and Entity Management application 

o Operational use of the Data Warehouse in Risk Assessment 

o Testing of the Address Verification Interface (AVI) data preparation, 
which will be used in Build 2 

e Build 2 — Planned to be implemented by July 2014 

o Electronic pre-arrival submission of importer information (advance trade 
and release data) 

o Automated risk assessment and Targeting Officer assessment (through 
new application) of importer, cargo, conveyance, and house bills in all 
modes (air, marine, highway, rail) 

o Data preparation and identity resolution 

o Passage: a new application for use by Border Services Officers to process 
commercial goods and conveyances at the border 

e Build 3 — Planned to be implemented by December 2014 
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o Submission of pre-arrival crew information in all modes through EDI 

o Submission of pre-arrival crew information in the highway mode through 
the eManifest Portal 

o Automated Risk Assessment and Targeting Officer Assessment of crew 

information in all modes 

Passage: extending to crew 

Third party information used in Risk Assessment 

Submission of re-manifests in all modes through EDI 

Enhancements to risk assessment application 


O OQ oO. “Or “© 


Enhancements to data preparation and identity resolution 


eManifest Build 1 Overview 

Build 1 of eManifest, requires trade chain partners (TCPs) which include carriers, freight 
forwarders and service providers, to transmit electronic advance cargo and conveyance 
information in the rail and highway modes, and house bills in the air, marine, rail and 
highway modes to the CBSA according to the timelines outlined in the following table: 


Timeframe 


A minimum of one hour prior to arrival 
in Canada 


A minimum of two hours prior to arrival 
in Canada 


Marine house bill information Twenty-four hours prior to loading on 


the vessel at the last foreign port of 
loading depending on type and origin of 
goods 

Air house bills information Four hours prior to arrival in Canada or 
at departure for flights less than 4 hours 
in duration 


Information Transmission Methods 
Two electronic transmission methods are available to TCPs: 


1. Electronic Data Interchange (EDI) 

Electronic Data Interchange (EDI) is a standards-based computer-to-computer 
communication method that allows the CBSA's TCPs to transmit trade information to the 
CBSA through one of four options: a value-added network, a third party service provider, 
the Customs Internet Gateway (CIG), or by a direct connection to the CBSA. 


TCPs must register with the CBSA before they can transmit information through EDI. 
The registration process is paper based. The TCP must send a completed registration 
form (available on the CBSA website) to the Technical Support Unit (TSU) or Electronic 
Commerce Unit (ECU). Upon approval, a technical profile is created in a CBSA internal 
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system. TCPs send messages to CBSA’s test environment and once approved can begin 
sending information to the live production environment. 


Application forms are stored in a locked cabinet and are only accessible by 30 people (15 
TSU employees and 15 ECU employees). 


The EDI transmission method is available for all eManifest submissions: cargo and 
conveyance submissions in rail and highway modes and house bill submissions in the 
rail, highway, air and marine modes. 


The personal information required in these submissions is limited to contact information, 
which has been listed in detail in section 3 of this PIA. The CBSA will not require that 
crew information be transmitted until Build 3 of the project when it will have the 
regulatory authority to collect this information; however, the EDI highway requirements 
for conveyance information do include crew information fields which are marked for 
future use. TCPs have been advised not to populate these fields, but many are doing so. 
The crew information is personal and therefore must be managed in accordance with the 
Privacy Act. It is important to note that while the CBSA will not have the regulatory 
authority to collect crew information electronically in advance in the marine, rail, and 
highway modes until 2015, the CBSA does have the authority to collect this information 
upon arrival. 


Information transmitted through EDI is processed by a legacy system called the Customs 
Electronic Commerce Platform (CECP) for basic syntax validation. If syntax errors are 
found, the information is sent back to the client. If no errors are found, the information 
(with the exception of unsolicited crew information) is passed onto the Accelerated 
Commercial Release Operations Support System (ACROSS) for business validation. 


Information received by the CECP can be viewed in the CECP system 
for client support or system administration purposes. These 

employees all have enhanced reliability security screenings. Access to the information 
within the CECP itself is not logged, but the CECP does not have the functionality to 
support searches by field, preventing specific personal information retrieval. At the end 

the information is transferred to a tape where it is stored in a locked room 
for 7 years, as part of a larger group of information elements which it cannot be separated 
from. can access the tape through sign in and approval. 


CECP is enterprise infrastructure, which is used across multiple business lines, one of 
which is eManifest 
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2. eManifest Portal 

An alternate transmission method is the eManifest Portal (Portal), a secure web-based 
information transmission environment developed by the CBSA to allow highway carriers 
to transmit their eManifest trade information to the CBSA electronically via the Internet. 
The eManifest Portal consists of two components: the Portal Application interfacing with 
the TCPs and the Portal Administration component interfacing with internal employees. 


Portal Application 

Highway carriers and freight forwarders in all modes use the Portal to transmit pre-arrival 
information, edit their submissions and check the status of their submissions. When air 
cargo arrives in Canada on a highway conveyance, referred to as a flying truck scenario, 
air carriers submit highway conveyance documents through the Portal. Warehouse 
Operators and Brokers can also use the Portal to view Manifest Forwards (see notices 
section below for more information). The Portal allows the user to save trade documents 
as drafts, retrieve, cancel or submit trade documents and edit submitted trade documents. 


The eManifest Portal further enables users to view, change, amend, cancel and verify the 
status of trade documents submitted though EDI. Users can obtain a status history and 
details regarding submitted trade documents. 


Syntax checks are completed in the Portal itself. The Commercial Trade Service (CTS) 
responds to the eManifest Portal application requests to submit and retrieve trade 
documents in XML format for authenticated and authorized Portal users. The information 
is then sent to ACROSS for business validation. 


Both internal and external access to the Portal Application is tracked and logged. 


Portal Registration Process 

Similar to the EDI process, Portal users must register with the CBSA and have a valid 
user account. The registration process requires company and personal information related 
to the user and acceptance of terms of use. The Portal retains the registration information, 
including limited personal information and shared secrets, in order to identify and 
authenticate users. 


Highway carriers must have a valid carrier code and a Shared Secret issued by the CBSA 
to register for an eManifest Portal Business Account. 


Shared Secret 

A Shared Secret is a temporary access code that a business will require to register for the 
eManifest Portal the first time. It will be issued to the authorized representative of the 
businesses that request access to the eManifest Portal and have a valid CBSA-issued 
carrier code. The Shared Secret will be used to authenticate and validate a highway 
carrier company when creating an eManifest Portal Business Account. Only the CBSA 
and the authorized representative of the company have access to this information. Third 
parties do not have access to this information. 
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Cyber authentication 


The Government of Canada is giving clients the option of using either a commercial 
credential service (Sign-In Partner) or a government-issued credential service (GCKey) to 
access online government services. 


e The Sign-In Partner is a credential service offered in collaboration with 
participating financial institutions. This service allows clients to log in to the 
eManifest Portal using their established online banking credential. 

e GCKey isa service that permits clients to use a unique government-issued 
credential that protects their communications with online government programs 
and services such as the eManifest Portal. 


Portal User Account 

An eManifest Portal User Account is a standard way for all users to establish their 
identity in the eManifest Portal. All users of the Portal must create an eManifest Portal 
User Account. To create User Accounts, clients will be required to log on to the Portal 
with their Cyber Authentication Credential and accept the Portal Terms and Conditions. 
The clients will need to provide personal information about themselves and their user 
preferences. The User Account will be created and a User Reference Number (URN) 
will be system-generated. The URN will be uniquely associated with the Portal User 
Account, and therefore the registrant. 


Portal Business Account 

A Portal Business Account is an area in the eManifest Portal dedicated to individual 
highway carrier companies to conduct secure information transmissions with the CBSA. 
Portal Business Accounts are managed by Account Owners who are authorized 
representatives of a highway carrier. To create a Business Account in the Portal, the 
carrier must provide a valid CBSA-issued highway carrier code and Shared Secret. A 
carrier code is a 4-character identifier issued by the CBSA to carrier companies. This is 
part of a pre-existing program activity and is outside the scope of eManifest. The 
issuance of the Shared Secret (described above) is new, and is the result of the 
implementation of the eManifest Portal registration requirements. Individuals will be 
required to provide personal information and the Business Account will be created (for a 
comprehensive list of registration information please see Section 3). The Account Owner 
may add additional users to the Business Account and assign them a role. To do this, the 
Account Owner must provide the designated user's URN, family name and email 
address, which must be obtained directly from the individual user. 


Portal Administration Application 
This component allows the Portal Administrators to provide client support and maintain 


the health and continued operation of the Portal. The Portal Administrators have the 
ability to monitor and view the details of all Portal Business Accounts. In order to ensure 
the health of the Portal and assist users, approximately 30 Portal Administrators are able 
to review and access all user profiles and preferences. The business information will 
always be displayed with the option of viewing additional details, such as notes, 
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attachments, event history and Portal users associated with the selected Portal Business 
Account. 


Information Validation 
ACROSS receives the trade information submitted through EDI or Portal, stores the 
information and validates business rules e.g. confirms the carrier code is valid, that 


province codes submitted in address fields are actual provinces. 


ACROSS is a legacy system and is not a component of eManifest. 


AS 


mentioned previously unsolicited crew information is not stored in ACROSS. 


A new application called Commercial Document and Entity Management (CDEM), will 
be replacing some ACROSS functionalities by the end of Build 2. It is now being 
established for that future purpose, and will be in production as of March 2014. CDEM is 
an application that owns, manages, processes, and queries all commercial documents. 
CDEM will store multiple versions of these documents for use by various project 
components. 


eManifest is being implemented incrementally, and until CDEM is fully operational and 
other new eManifest risk assessment components are implemented (Build 2), ACROSS 
and CDEM will be run in parallel. For Build 1, only the ACROSS version of the data is 
being risk assessed, and CDEM is really just being established for its future use in Build 
2. More information on CDEM will be provided in the Build 2 PIA, once it is being used 
for risk assessment. However, it is not a user-facing system and is simply replacing old 


functionality and will be able to manage various statuses of documents. | 
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Notices 


Notices refer to electronic messages that are sent back to the TCP, in response to the 
information they have submitted. Trade documents that contain syntax or business 
validation errors are rejected back to the client for amendment. When a trade document 
passes syntax and business validation, an acknowledgement message is sent back to the 
client. 


Build 1 of eManifest introduces new notices called the Completeness notices which do 
not contain personal information: 


e Matched Completeness Notice — an electronic notice that is generated and sent 
to the affected CBSA clients that indicates valid information has been transmitted 
to the CBSA and accepted, and paired with related transmitted information. 
Examples include cargo information matched with electronic release entries, and 
consolidated house bill information matched with House Bill Close Message 
information. 


e Not Matched Completeness Notice — an electronic notice that is generated and 
sent to affected CBSA clients when valid information that was previously 
matched to other valid information is cancelled, causing it to be no longer linked. 
A Not Matched Notice will also be generated and sent to CBSA clients when 
valid trade information has been transmitted but not linked to other valid trade 
information. 


Build 1 also introduces two new messages that the TCPs send to the CBSA which do not 
contain any personal information: 


e Arrival Notice — TCPs in the rail, air and marine modes send a Conveyance 
Arrival Certification EDI message to the CBSA to report their arrival at FPOA. 


e House Bill Close Message - is used to reconcile the correct number of house bills 
by quoting the previous Cargo Control Number (CCN) related to a consolidation. 
The Close Message also lists the carrier's cargo transmission that is to be 
deconsolidated and all the documents that make up the deconsolidation. 
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This Build also introduces Manifest forward functionality, which allows freight 
forwarders to forward a copy of their house bills to another registered TCP, by inputting 
that client's ID in the Secondary Notify Party field on the transmission. As mentioned 
above, house bill transmissions do include contact information (personal information in 
the case of sole proprietorship), which is shared with the TCP through this functionality. 


Personal Information Uses 

The personal information submitted in the cargo, house bill and conveyance (with the 
exception of crew) documents is used to determine admissibility and for risk assessment, 
business analytics, reporting, compliance monitoring, and client support. 

Registration Information is used for registration, testing and client support. 
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user roles. Users belonging to a specific user role will be authorized to see certain parts 
of data in designated tables. 


End-User Tool Access 


Security features include role specific user permission, and request 
level usage audits. 


Enterprise Data Warehouse Access 


The following process has been defined for Enterprise Data Warehouse permission 
granting: 
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do 3 weeks to complete. 
E Fa е role thor access DO pro i: Gato ie 433 


Bored aed Gien. 


User Permissions Review Process 


1) Permission reviews will be conducted on a bi-annual basis, triggered Apr 2 & Oct 
2 


2) End-User and approving director contact list housed in MS Outlook EDW 
Distribution List, owned by BIRA director 


3) EDW permissions controls conducted via MS-Outlook dedicated email account 


4) Contact with end-users initiated by the BIRA division administration office and 
logged in the Outlook account 


5) Renewal approvals, de-commissioning of accesses logged in the Outlook account 
with indefinite retention 


6) Permission information does not exit the MS-Outlook account except where 
authorized by the Director for audit purposes. 
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Audit Trail Implementation 


At the time the previous version of the PIA was submitted, the EDWE did not have audit 
trails in place. Audit trails have since been implemented as follows: 


IBM SPSS Data Modeller Audit Trail Specifications 
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Implementation Approach 


Build 1 was implemented in four stages: 

1. October 2010 — CBSA systems began receiving electronic pre-arrival submission 
of cargo and conveyance information in the highway mode; 

2. August 2011 - the eManifest Portal was introduced as an alternative information 
transmission method to EDI for highway cargo and conveyance information; 

3. May 2012 – CBSA systems began receiving electronic pre-arrival submission of 
cargo and conveyance information in the rail mode; and 

4. June 2013 - CBSA systems began receiving electronic pre-arrival submission of 
house bill information in the highway, rail, air and marine modes. 


The CBSA has developed an implementation strategy for eManifest where participation 
is voluntary for the first year following each implementation date to allow clients time to 
prepare for mandatory program requirements. This is followed by a 6 month informed 
compliance period where only zero-rated penalties are applied, at the end of which 
participation will be mandatory. 


The voluntary submission period for highway trade documents was lengthened because 
the required regulatory amendments were delayed. These amendments will be in place in 
the summer/fall of 2014, and highway reporting requirements will be mandated at that 
time. 


| SECTION 2 - RISK AREA IDENTIFICATION AND CATEGORIZATION 


Type of Program or Activity Level of Risk 


Program or activity that does NOT involve a decision about an identifiable individual EE 
| Personal information is used strictly for statistical / research or evaluations 

including mailing list where no decisions are made that directly have an impact on 

an identifiable individual. 

The Directive on PIA applies to administrative use of personal information. The 

Policy on Privacy Protection requires that government institutions establish an 

institutional Privacy Protocol for addressing non-administrative uses of personal 

information. 


| Administration of Programs / Activity and Services Dx] 2 
| Personal information is used to make decisions that directly affect the individual 
(1.e. determining eligibility for programs including authentication for accessing 
programs/services, administering program payments, overpayments, or support to 
clients, issuing or denial of permits/licenses, processing appeals, etc...). 


Compliance / Regulatory investigations and enforcement LI 3 
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Personal information is used for purposes of detecting fraud or investigating 
possible abuses within programs where the consequences are administrative in 
nature (1.e. a fine, discontinuation of benefits, audit of personal income tax file or 
deportation in cases where national security and/or criminal enforcement is not an 
issue). 


) Criminal investigation and enforcement / National Security | |4 


Personal information is used for investigations and enforcement in a criminal 
context (1.e. decisions may lead to criminal charges/sanctions or deportation for 
reasons of national security or criminal enforcement). 


Details: The information contained within the cargo and house bill transmissions is used to determine 
) the admissibility of a shipment into Canada, not people. The majority of this information is customs 

- information, however name and address fields (shipper, consignee, notify, delivery, dangerous goods 

) contact) are classified as personal information if they represent a sole proprietorship. In this case we 

- are risk assessing the business, not the person. This information is also used for business analytics and 
| reporting purposes in EDWE. Unsolicited crew/passenger information, which is personal information, 
| may be submitted as part of the highway conveyance report, and will not be used for any purpose. 

- Personal information will be used with respect to the issuance of the Shared Secret as well as for the 
eManifest Portal Account registration and EDI registration. 
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Type of Personal Information Involved and Context 
Only personal information, with no contextual sensitivities, collected directly from the 
individual or provided with the consent of the individual for disclosure under an 
Dx] 2 


authorized program. 


Personal information, with no contextual sensitivities after the time of collection, 
provided by the individual with consent to also use personal information held by 
13 


) another source. 
and/or the context surrounding the personal Information 1s sensitive. Personal 
14 


Social Insurance Number, medical, financial or other sensitive personal information 
information of minors or incompetent individuals or involving a representative acting 


on behalf of the individual. 
Sensitive personal information, including detailed profiles, allegations or suspicions, 
bodily samples and/or the context surrounding the personal information is particularly 


sensitive. 
Details: The personal information provided on the cargo and house bill submission includes company 
name and address information which may represent a sole proprietorship. The unsolicited crew personal 
information, which is not used, if submitted as part of the conveyance submission, includes name, 
tification. The categories of personal information 
le name and contact information and are only 


: address, contact information and travel documen 
provided as part of the Shared Secret application 


include position title, name & contact information 
for a detailed listing of the Personal Information Ele 


al information provided in the cargo, and conveyance submissions will be received by high 
and rail carriers in the trade community, or by a service provider on their behalf. Personal information 
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forwarders in the trade community, or by a service provider on their behalf. Unsolicited crew 
information may be received from highway carriers from the private sector. This unsolicited 
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information will not be used. 


) Highway Carriers will also provide personal information as part of the Shared Secret Application. In 

) turn the CBSA will issue a Shared Secret to the authorized representative of the company who applied 
after verification at the business level has occurred to ensure that all elements provided are correct | 

- ct name. Personal information will be exchanged between hi; 
he eManifest Portal as part of the Registration Process. 


ation received (with the exception of crew information) may be shar 
ents (OGDs) and United States Customs and Border Prot 


- Freight Forwarders may elect to share their submission with other TCPs electronically by using the 
Manifest Forward notice. 


Duration of the Program or Activity | Level of risk ) 


One time program or activity [|1 


Typically involves offering a one-time support measure in the form of a grant 
payment as a social support mechanism. 


) Short-term program | |2 
A program or activity that supports a short-term goal with an established “sunset” _ 

date. 
Long-term program Е 


Existing program that has been modified ог is established with по clear “sunset”. 


) Details: 
 eManifest is a long term program with no suns 
ds currently being submitted on a voluntary basis 


information 
The 


The program affects certain employees for internal administrative purposes. ) [ ]1 


The program affects all employees for internal administrative purposes. [712 


| апа j freight f forwarders | in a all modes, involved i in the transportation of commercial ve into "Canada 
and third parties whose information is collected. Third parties include shipper, consignee, notify and 
delivery parties. 
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This information is collected to complete pre-arrival risk assessment of commercial goods, conveyances - 
and equipment coming into Canada. | 


6.1 Does the new or modified program or activity involve the implementation of a new Dx] 
! electronic system, software or application program including collaborative software (or YES 
groupware) that is implemented to support the program or activity in terms of the | INO 


creation, collection or handling of personal information? 


6.2. Does the new or modified program or activity require any modifications to IT legacy X 
| systems and / or services”? | YES 


6.3 Does the new or modified program or activity involve the implementation of one or 
- more of the following technologies: 


6.3.1 Enhanced identification methods: ) L| 


This includes biometric technology (1.e. facial recognition, gait analysis, iris scan, ) YES 
fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as ` PX NO 
well as easy pass technology, new identification cards including magnetic stripe | 

cards, “smart cards" (1.e. identification cards that are embedded with either an 

antenna or a contact pad that is connected to a microprocessor and a memory chip 

or only a memory chip with non-programmable logic). 


6.3.2 Use of Surveillance: | [| 
This includes surveillance technologies such as audio/video recording devices, YES 
thermal imaging, recognition devices, RFID, surreptitious surveillance / | [x] NO 
interception, computer aided monitoring including audit trails, satellite surveillance - 
etc. 

Details: | 

6.3.3 Use of automated personal information analysis, personal information matching хі 
and knowledge discovery techniques: . YES 


For the purposes of the Directive on PIA, CBSA is to identify those activities that — |. | NO 
involve the use of automated technology to analyze, create, compare, cull, identify _ 

or extract personal information elements. Such activities would include personal 

information matching, record linkage, personal information mining, personal 

information comparison, knowledge discovery, information filtering or analysis. 

Such activities involve some form of artificial intelligence and/or machine learning 

to uncover knowledge (intelligence), trends/patterns or to predict behaviour. 
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ation Transmission 


The personal information is used within a closed system. 


No connections to Internet, Intranet or any other system. Circulation of hardcopy 
documents is controlled. 


The personal information is used in a system that has connections to at least one other [Х| 2 
system 
The personal information is transferred to a portable device or is printed. [x] 3 


USB key, CD-Rom, laptop computer, any transfer of the personal information to a 
different medium. 


Details: 


_ Personal information in the cargo, house bi 
: (all modes) or Portal (cargo/conveyance hi; 
assessed in CECP; Portal information is a 
ACROSS system and then EDWE (with th 
| The Shared Secret application, contains pers 

carrier via hard copy (1.е.: mail/fax) or electron 


nce submissions are submitted through EDI 
ouse bills all modes). EDI information is 
information is then shared with the 

w information). 

ation and is provided to the CBSA from the 
1ailed as a scanned PDF). 


| The CBSA prints and mails the Shared Secret Letter (including name & Shared 
) Secret) back to the originating client (1.e.: authorized individual who applied). 


The personal information provided as part of the portal registration and trade information will be 
transmitted electronically through the eManifest web portal. | 


Managerial harm. 
Processes must be reviewed, tools must be changed, change in provider / partner. 
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) Organizational harm. | | j2 


Changes to the organizational structure, changes to the organizations decision- 
making structure, changes to the distribution of responsibilities and 
accountabilities, changes to the program activity architecture, departure of 
employees, reallocation of HR resources. 


- Financial harm. HE 
Lawsuit, additional moneys required reallocation of financial resources. 


Reputation harm, embarrassment, loss of credibility. Dx] 4 
| Decreased confidence by the public, elected officials under the spotlight, | 

institution strategic outcome compromised, government priority compromised, 

impact on the Government of Canada Outcome areas. 


) Details: If trade information that contains personal information became public knowledge, the CBSA 
| could lose credibility with the public. 


Risk Impact to the Individual or Employee ) Level of Risk 
oe. EEE OS 
aaa; °C I-A 
"NE 713 
Physicalharm. = 74 
Details: An unintentional breach or disclosure с ad to financial harm for a sole proprietor. 
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| SECTION 3 - ANALYSIS OF PERSONAL INFORMATION ELEMENTS 


Personal Information Elements and Sub-elements 


) Category Of | Personal Information | Personal Information ! Format Purpose / Necessity 
Personal Information — — — emer em Sub-Element — _ реше _ 
) Contact ) Name and Address | 1) Dangerous Goods Name and ) Electronic : This information is submitted as part of the 
Information | | phone number ) cargo and house bill information. It is used — 
| ` 2) Place of Consolidation Name and . for risk assessment purposes in order to make — 

` Address ) an admissibility decision regarding cargo. : 

| 3) Shipper Name and Address | 

| 4) Consignee Name and Address 

| 5) Notify party Name and Address 

| 6) Delivery Address Name and 

_ Address 

| 7) Place of Acceptance 

| 8) Consolidator Name and Address 
| Contact | Crew Member 1) First Name | Electronic CBSA does not require this information and is | 
Information Information .2) Middle Name : not requesting it in advance at this time as : 
: : | 3) Last Name | | part of an EDI Highway conveyance 


| | transmission. In the event that it is received 
| 4) Date of Birth | _as part of an eManifest transmission it will 
5) Citizenship/Nationality | поё be used. 
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Category Of : Personal Information Personal Information ) / Purpose / Necessity 
Personal Information . Element 2 Sub-Element ; of Element 


6) Travel Document Type 
: 7) Travel Document Number 
. 8) Country of Issuance 


) Shared Secret shared Secret 1) Company Name Electronic | Shared Secret Application information is used : 
Application | | Application .2) Carrier Code Or to: | 
| | 3) Contact Name and Title | Paper = identify, authenticate and verify 

4) Signature of Authorized Officer of : the authorized officer of the 

|. the Company COPA 


" contact the authorized officer of 


5 Contact Phone Numb 
P EOE NUE the company and mail Shared 


6) Contact email Address 


| Secret. 

. 7) Official Mailing Address 
| eManifest | eManifest Portal 1) First Name Electronic | eManifest portal User Account information 1s 
. Portal User ) User Account 2) Family Name used to: - 
ош 3) Email Address - = identify user (User Reference 


Number is generated to manage 


.4) Telephone Numb HR ou 
о their permissions in the portal) 


: 5) Language Preference 


: = contact client 
6) URN 


= identify which official language 
will be used for communication 
with client 


Ассори Owner | 1) Position Title ) Electronic Account Owner information is used to 
Information | 2) Email Address ) identify the person responsible for the Portal 


Canada Border Services Agency PROTECTED В 


000577 


Canada Border Services Agency/ Advance Commercial Information / eManifest Build 1 | PIA 


Category Of Personal Information 
Personal Information — — Element — 
ТРЕ" 


- Information 


Contact 
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.3) Telephone Number 
| 4) Address 

| 5) City 

6) Country 

| 7) Province/State 

| 8) Postal/Zip Code 


.]) Business Name 

2) Client Identifier 

| 3) Business Type 

| 4) Contact First Name 

| 5) Contact Family Name 


Personal Information 
Sub-Element 


Electronic 


6) Contact Telephone Number 

| 7) Contact Telephone Extension 
| 8) Address 

9) City 

| 10) Province/State 

| 11) Postal/Zip Code 

. 12) Country 


- 1) Company Contact Information АЙ. ш 


Official Title 


| 2) Company or Contact person 


Purpose / Necessity 
of Element 


Business Account as outlined in the terms and 
conditions. - 


Business Information is used to identify the 
business entity that is registered for a Portal _ 
Business Account for purposes to interact and — 
transmit prescribed information to the CBSA _ 
| via the eManifest Portal. Business 
Information is also used to keep TCP records 
up to date with the CBSA as they can request 
an update through the Portal. 


) This information is used to register the client 
for an EDI account and to contact the client. 
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Category Of : Personal Information Personal Information ) Purpose / Necessity 
Personal Information . Element : Sub-Element / ; of Element 


telephone number 


3) Company or Contact person Fax 
| .. number 


4) Company Contact email address 


| 5) Preferred language of 
|. communication 


6) Name of individual as company 
¬ official 


7) Signature of Company official ) 


: Other 2 : 1) Tractor plate and identifier | Electronic | This information is submitted as part of the ) 
: - : | cargo and house bill information. It is used for 


risk assessment purposes in order to make an 
admissibility decision regarding cargo. 


| 2) Trailer plate and Identifier 


.3) Business to Business 
| Comments 
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| SECTION 4 - FLOW OF PERSONAL INFORMATION 


4.1 eManifest Information Flow 


External 


- External 
: Trade Data 


SANA AAA 


Canada Border Services Agenc 


EDI data transmissions are received in the CECP, 
Portal data transmissions are received in CTS and 
forwarded to the ACROSS systern for targeting 


| Personal information may | 
| beprovidedbyandto — | 
domestic government | 
| departments and agencies | 
| asa result of intelligence or, 
: investigative activities {Le | 
| Highway carriers transmit : RCMP, CSIS) as well as with | 
| cargo and conveyance data | | the US. CBP / 
| and air carriers submit | ono ie 
| highway conveyance data via — | 
: the eManifest Portal, 


| Highway and rail carriers {or 

| thelr authorized service 

: providers) transmit cargo and 
| conveyance data via electronic 
| data interchange (EDI) 


| Freight forwarders (or their 

| authorized service providers} 
| transmit house bill data via 

| EDI {all modes) 


- Freight forwarders transmit 
| house bill data via the 
| eManifest Portal {all modes) 


Registration Officers review, approve and capture 
| requests for shared secrets in PAA, generate 

| shared secrets in PAA and issue shared secrets by 
_ mail to business account owners 


Registration Data 


| Business account owners 
| transmit shared secret 
| requests via fax, mail or email 


EU e Technical Support Officers review business account 
| using company letterhead 


and user account Information in the Portal 
Administration Application when providing client 
support 


| Business account owners and 
| users transmit registration 

| data via the eManifest Portal 
| to the Portal Account 

| Administration system 


Program, Technical Support and eManifest Project 
Officers view reports on data transmission 
volumes, eManifest Portal account activity and 
compliance 


| Storage/Retention | Storage/Retention 
| Cargo Data: 3 years plus | 
| current 
| Importer Data: 6 years plus 
| current 


CBSA: Commercial data = 15 years plus current; 
Unsolicited crew data stored for 7 years on CECP : 
back-up tapes; RDA for the CBSA is being negotiated. : 
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4.2 Information Flow Model - Table 


| SOURCE IDENTIFY THE SOURCE 

The individual or a representative © For the Portal and EDI Registration 

) | Process the individual is the source 

A federal government institution (identify .* The Canada Border Services Agency 

_ from what PIB the information is - (CBSA) will provide the Shared Secret to _ 
obtained) _ the individual (no one else will have access - 


to this information). 


| = Canada Border Services Agency PIB 
... CBSA PPU 048 


= Provincial Government N/A 
س‎ VARI en —O—— "—s— — 
мос Т хош ә ————Э5ЯА 
== ооло ое шш: ا‎ 
m o جج‎ 


= Located in Canada and Canadian | = Highway or Rail Carrier or their 
Owned | Service Provider will provide personal 
: information in the cargo, or 
conveyance submission. 


= Freight Forwarders or their Service 
Provider in all modes will provide 
personal information in the house bill 
submission. 

= Highway Carrier or their Service 
Provider may provide unsolicited 
crew/passenger information. 

= For the Portal and EDI Registration 
Process the individual is the source 


" Freight forwarders or their service 
provider may elect to have their 
submitted information forwarded to 
another TCP using the manifest 
forward functionality. 
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= Located in Canada and Foreign Owned 


Highway or Rail Carrier or their 
Service Provider will provide personal 
information in the cargo, or 
conveyance submission. 


Freight Forwarders or their Service 
Provider in all modes will provide 
personal information in the house bill 
submission. 


Highway Carrier or their Service 
Provider may provide unsolicited 
crew/passenger information. 


For the Portal and EDI Registration 
Process the individual is the source 


Freight forwarders or their service 
provider may elect to have their 
submitted information forwarded to 
another TCP using the manifest 
forward functionality. 


= Located abroad and Canadian Owned 


Highway or Rail Carrier or their 
Service Provider will provide personal 
information in the cargo, or 
conveyance submission. 


Freight Forwarders or their Service 
Provider in all modes will provide 
personal information in the house bill 
submission. 


Highway Carrier or their Service 
Provider may provide unsolicited 
crew/passenger information. 


For the Portal and EDI Registration 
Process the individual is the source. 


Freight forwarders or their service 
provider may elect to have their 
submitted information forwarded to 
another TCP using the manifest 
forward functionality. 


Highway or Rail Carrier or their 
Service Provider will provide personal 
information in the cargo, or 
conveyance submission. 
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Provider in all modes will provide 
personal information in the house bill 
submission. 


= Highway Carrier or their Service 
Provider may provide unsolicited 
crew/passenger information. 


= For the Portal and EDI Registration 
Process the individual is the source 


= Freight forwarders or their service 
provider may elect to have their 
submitted information forwarded to 
another TCP using the manifest 
forward functionality. 


. HQ Project teams: _eManifest PIB 4 CBSA PPU 048 
National Targeting Centre (NTC) | 
Regional Commercial Operations 

IT CECP 

IT Administration 

IT Development 

IT Analysis 

IT Testing 

IT Maintenance 

IT ACROSS 

Electronic Commerce Unit 

eManifest Technical Support Unit 

eManifest project teams 


Compliance Verification (Advance 
| Commercial Information Policy Unit) 


Trade Compliance 

| Pre-Border Programs 

| Border programs 

| Business Intelligence and Risk 
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Assessment Division 


eManifest Business Design and 
Development 


eManifest Stakeholder Consultations and 
Implementation 


) Intelligence Programs 
| Intelligence Operations 
| Enforcement 


The individual or a representative Individual - the Shared Secret will be issued to 
| the authorized representative of the company 
who applied for it. It will not be issued to a 
- third party. 


_A federal government institution . RCMP and CSIS (Note: Disclosure may 
take place in accordance with Section 8(2) 
| of the Privacy Act). This is not within the 
scope of eManifest. 
. May be shared with other government 
_ departments where established programs 
are in place. 


= Provincial Government N/A 
т ana °° oo o a 
ләә — S + : ttn 
m Sg em ue ure te ~~ Chor I HE E OE TUR 


- Protection. 


= Located in Canada and Canadian | e Highway Carriers and Freight 
Owned : Forwarders in all modes will have | 
: access to the eManifest Portal to submit - 
and edit their submissions as well as 

view statuses of their submissions. 
When air cargo arrives in Canada on a 
highway conveyance, referred to as a 
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flying truck scenario, air carriers submit - 
highway conveyance documents | 
through the Portal. Warehouse 

Operators and Brokers can also use the 
Portal to view Manifest Forwards. This 
applies only to the account they have 
been granted access to. 


Using the Manifest Forward | 
functionality, when a Freight Forwarder - 
sends a house bill to the CBSA he сап _ 
elect for it to be sent to a carrier, 

broker, warehouse operator, or another 
freight forwarder. 


= Located in Canada and Foreign Owned 


Highway Carriers and Freight 
Forwarders in all modes will have 
access to the eManifest Portal to submit - 
and edit their submissions as well as | 
view statuses of their submissions. 

When air cargo arrives in Canada on a 
highway conveyance, referred to asa 
flying truck scenario, air carriers submit - 
highway conveyance documents | 
through the Portal. Warehouse 

Operators and Brokers can also use the 
Portal to view Manifest Forwards. This 
applies only to the account they have 
been granted access to. 


Using the Manifest Forward | 
functionality, when a Freight Forwarder - 
sends a house bill to the CBSA he сап _ 
elect for it to be sent to a carrier, 

broker, warehouse operator, or another 
freight forwarder. 


= Located abroad and Canadian Owned 


Highway Carriers and Freight 
Forwarders in all modes will have ) 
access to the eManifest Portal to submit 
and edit their submissions as well as 
view statuses of their submissions. 

When air cargo arrives in Canada on a 
highway conveyance, referred to asa 
flying truck scenario, air carriers submit 
highway conveyance documents ) 
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through the Portal. Warehouse 
Operators and Brokers can also use the 
Portal to view Manifest Forwards. This 
applies only to the account they have 
been granted access to. 


e Using the Manifest Forward | 
functionality, when a Freight Forwarder - 
sends a house bill to the CBSA he can 
elect for it to be sent to a carrier, 
broker, warehouse operator, or another 
freight forwarder. 


= Located abroad and Foreign Owned e Highway Carriers and Freight 
: Forwarders in all modes will have 

access to the eManifest Portal to submit - 
and edit their submissions as well as | 
view statuses of their submissions. 
When air cargo arrives in Canada on a 
highway conveyance, referred to asa 
flying truck scenario, air carriers submit - 
highway conveyance documents | 
through the Portal. Warehouse 
Operators and Brokers can also use the 
Portal to view Manifest Forwards. This 
applies only to the account they have 
been granted access to. 


e Using the Manifest Forward | 
functionality, when a Freight Forwarder - 
sends a house bill to the CBSA he сап _ 
elect for it to be sent to a carrier, 
broker, warehouse operator, or another 
freight forwarder. 


e Unsolicited Crew information 
contained within a conveyance 
transmission in CECP will be 
stored on a backup tape for 7 
years, which will only be 
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| Highway and rail carriers, freight 


= Located in Canada and Canadian Owned 


Canada Border Services Agency PROTECTED B 


accessible by IT production and 
development staff. 

Shared Secret applications will 
be saved on the Carrier Record, 
which 1s accessible through a 
Microsoft Access Database 


(Darryl) if completed at the same 


time as applying for a carrier 
code. All the information 
provided in the Shared Secret 


Application and eManifest Portal ) 


Registration sections are stored 
in PAA except for the User 
Account Information which 1s 
stored in Identity Manager 
(LDAP). 


Personal information elements in 


the cargo, house bill and 
conveyance (except for crew 
information), will be stored in 
ACROSS and EDWE for 15 


years plus current. They will also 


be stored on a backup tape in 
CECP for 7 years and only 
accessible to IT production and 
development staff. 


Portal Trade information is 
stored in the Portal for 90 days 


and is accessible by TCPs during ) 


that time. 
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| providers retain records of submitted 
| information. The regulated retention 
| periods are 3 + 1 year for the private 
: sector for cargo related information. 


= Located in Canada and Foreign Owned Highway and rail carriers, freight 
. forwarders in all modes, and service 
| providers retain records of submitted 
| information. The regulated retention 
| periods are 3 + 1 year for the private 
Sector for cargo related information. 


= Located abroad and Canadian Owned | Highway and rail carriers, freight 
forwarders in all modes, and service 
| providers retain records of submitted 
| information. The regulated retention 
| periods are 3 + 1 year for the private 
sector for cargo related information. 


= Located abroad and Foreign Owned Highway and rail carriers, freight 
-forwarders in all modes, and service 
| providers retain records of submitted 
| information. The regulated retention 
| periods are 3 + 1 year for the private 
sector for cargo related information. 


4.6 Other Possible Considerations 
Identify the areas, groups and individuals who access and handle the personal information: 
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Identify Groups or Areas / or . Positions who have access or use ће Geographical Location 
Divisions : personal information (where | 
: appropriate) 

` Regional Commercial Operations Border Services Officers . Commercial Ports across 
ooo Clerical Support Staff Canada| 
| National Targeting Centre Targeting Officers Ottawa | 
E ITCECP A ITOfficers 1 1 HQ-Otawa — 
IT Administration IT Officers — — 11 HQ-Otawa ——— 
t IT Development IT Officers | . .— HQ-Otawa v—. 
IT Analysis —— — ITOfficers  —n HQ-Otawa —— 0 
И IT Testing  ШОбседәя– HQ-Otfawa — — 
IT Maintenance ITOfficers  — 1 HQ-Otawa —— 
i IT ACROSS ITOfficers .  — 1 1 HQ-Otawa — 

eManifest Technical Support Technical Support Officers HQ - Ottawa 
Unit 
 eManifest project Teams | Program Officers HQ - Ottawa 
' Managers : 
Constants — — ^ 0000000000000 
B Compliance Verification Ргоргат Officers HQ-Ottawa —— č 

Electronic Commerce Unit Technical Support Officers HQ Ottawa 
E (ECU) 
` ACI Policy Unit (Compliance | Program Officers HQ - Ottawa 
Monitoring) — ^ ^ ES PS 
` Pre-Border Programs Programs Officers HQ - Ottawa 

Border programs | Programs Officers HQ - Ottawa 
Business Intelligence and Risk | Programs Officers HQ - Ottawa 
Assessment Division | Consultants ) 
` eManifest Business Design | Programs Officers НО - Ottawa 
and Development Consultants 
 eManifest Stakeholder | Programs Officers . HQ - Ottawa 
Consultations and | Consultants | 


) Implementation 


Reporting _ Intelligence Officers  HQ/Regions 
Programs | 
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| SECTION 5 - PRIVACY COMPLIANCE ANALYSIS 


Has a legal authority been identified for the collection of personal information for this program or 
activity? 


Statutory reference: Section 4 of Privacy Act (Section 4 has been interpreted to mean that a ) 
legal authority must be established for a collection of personal information, but section 4 2 
does not provide legal authority for such a collection). 
Policy reference: Section 6.2.6 of Directive on Privacy Practices 

| Yes 

1.1 DA Specify the legal authority and briefly explain its connection to the program or activity or 

: how it permits the collection of the personal information: 


| Section 12.1 Customs Act 
| 12.1 (1) Before the arrival of a conveyance in Canada, the owner or person in charge of a 


conveyance who is prescribed or any other prescribed person shall give the Agency 
| prescribed information about the conveyance and the persons and goods on board ог 
| expected to Бе on board ће conveyance. 


| (2) A person who is required to provide information under subsection о shall hold a 
ode unless they are exempt. - 


Ат application for a carrier code shall be made in the prescribed form with the 
'ed information. 
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| prescribed requirements and conditions for the carrier code to be issued have been met. 


| (5) The Minister may, subject to the regulations, suspend, cancel or reinstate a carrier 
code. 


ay issue a notification to any person who provides infc 
1) to require the person to take any specified measure with respect 1 


to whom a notification is issued shall comply with the not 


(8) The Governor in Council may make regulations for the purposes of this section, 
including regulations 

(a) respecting the information that must be given under subsection (1); 

(b) prescribing the persons or classes of persons who must give the information under 

_ subsection (1); 

(с) tespecting the circumstances in which the information must be given under subsection 
(d) respecting the time within which an 
given under subsection (1); 
_ (е) regarding the requirements and conc 
be issued; | 
| (f) regarding the persons or classe: 

- code; and 
(2) regarding the manner and circun 
cancelled or reinstated. 


ner in which the information must be 
e to be met before a carrier code may 


exempt from holding a valid carrier ) 


Section 107.1 Customs Act 
107.1 (1) The Minister may, under prescribed сіт cumstances and conditions, require any — 
| prescribed person or prescribed class of persons to provide, or to provide access to, within - 
) the prescribed time and in the prescribed manner, prescribed information about any person | 
) on board or expected to be on board a conveyance. | 


Section 7.1 Customs Act 

Obligation to provide accurate information 

71 Any information provided to an officer in the administration or enforcement of m 
| | l'ariff or the Special Import Measures Act or under any oth f 


ue, accurate and complete. 
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Details: Yes, this personal information is used for risk assessment in order to determine 
 admissibility. 


— Continue to Question 2 


| No 

1.3 [| | Ifthere is no legal authority for the collection of personal information, it cannot be collected. 
Please consult your legal advisor to determine if there is authority to proceed with the 
program or activity. **The PIA process must not continue without this key 


information. ** 


) Is each element and sub-element of personal information collected or to be collected necessary to 
administer the program or activity? 


Statutory reference: Section 4 of Privacy Act 
Policy reference: Sections 6.1.1, 6.1.3, 6.1.4, 6.2.7 and 6.2.8 of Directive on Privacy 
Practices 

YES 

2.1 Dx] Ensure that all personal information necessary to administer the program or activity is listed 
in the relevant PIB. 


22 | | AND, implement controls and procedures to ensure the CBSA does not collect more personal ) 
| information than is necessary for the identified program or activity and that a continuing need © 
exists for that information or its collection. 


lá Please note: Unsolicited crew information is not necessary for the program and in fact is not 
used for the program. Unfortunately we have no way of stopping this information from 
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being sent, however, we can ensure it isn't used and control the access. 


2.3 Are secondary uses contemplated for the information collected? 
/ | YES [X] NO (Continue to Question 3) 


2.3.2 If yes, is there authority for the use or disclosure of the personal information? 


| ** Please ensure that the Legal Authority identified above allows for all uses and disclosures of 
| the personal information.** 


| | YES | INO 


— Continue to Question 3 
| NO | 
2.4 |_| Review the proposed elements and sub-elements of personal information outlined in “Section ) 
| 3 — Analysis of Personal Information Elements" to identify those that are “necessary” and not 
merely useful. Document any changes. 


Is the collection of the Social Insurance Number (SIN) necessary to administer the program or 
activity? 


Statutory reference: Section 4 of Privacy Act 


Policy reference: Section 6.2.13 of Policy on Privacy Protection and sections 6.1.1 and 6.2 
to 6.4 of Directive on Social Insurance Number 


Also see "Guidance for Preparing Information-Sharing agreements Involving Personal 
Information" and *Taking Privacy into Account Before making Contracting Decisions" 


YES 


) 3.1 [|_| Collection of the SIN must be in compliance with the Directive on Social Insurance Number 
: (please check all appropriate boxes below): 


| 3.2 [| ] State legal authority for collecting the SIN: 


OR, in the absence of a legal authority to collect the SIN: 

) 3.3 [_] Establish explicit authority through legislative amendment(s). 

| 3.4 | |] Establish legal authority as outlined in the Directive on Social Insurance Number. 

| AND, if disclosure of the SIN by the CBSA is to occur on a routine or systematic basis 


3.4.1 | | to another federal institution that is authorized to collect it, or to another level of 
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government, establish an agreement or arrangement that includes specific provisions to 
limit the use of the SIN. 


3.4.2 | | toa contractor or other external service provider, establish a contract that includes 
specific provisions to limit the use of the SIN. 


) 3.5 L] AND, ensure that the relevant PIB for the program or activity states the authority under 
which the SIN is collected and the purpose for which it is used. ! 


— Continue to Question 4 
NO 


3.6 [X] The SIN is not necessary and it will not be collected, used or disclosed to administer the 
program or activity. 


Is personal information collected directly from the individual to whom it relates? 


Statutory reference: Sections 4 and 5 of Privacy Act 


Policy reference: Sections 6.1.1, 6.2.6 and 6.2.9 to 6.2.13 of Directive on Privacy Practices 
and section 6.1.2 and 6.4.1 of Directive on Social Insurance Number 


YES — for Registration Information only, Not for Trade information 


4.1 DX] A “Privacy Notice" (adapted for either verbal or written communications) must be provided 
| to the individual at the time of collection and it must include the following elements: 


a) The purpose and authority for the collection 
b) Any uses or disclosures that are consistent with the original purpose. 
c) Any uses or disclosures that are not related to the original purpose 


d) Any legal or administrative consequences for refusing to provide the personal 
information 


e) That the "individual to whom the information relates" has rights of access to, correction 
of and protection of personal information under the Privacy Act. 


f) A reference to the for the program or activity 
g) Why the SIN is collected, how it will be used and the consequence of not providing it. 


AND, add a “Consent Statement" to the “Privacy Notice" as appropriate, if the personal 
information is to be used or disclosed for a purpose other than the original purpose (Secondary 
Use) or a consistent use, or, to authorize indirect collection of personal information. 


4.2 | | The “Consent Statement" must include the following elements: 
a) The purpose of the consent and the specific personal information involved. 
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b) In the case of indirect collections, the sources that will be asked to provide the 
information. 


c) Uses and disclosures that are not consistent with the original purpose of the collection 
and for which consent is being sought. 
d) Any consequences that may result from withholding consent. 
e) Any alternatives to providing consent 
4.3 [| AND, implement controls and procedures to ensure that the CBSA keeps a record 


documenting whether or not an individual provided consent when it was sought, including a 
record documenting any withdrawal of consent when applicable. 


Additional Consent Considerations (s. 77(1)(m) of the Privacy Act): 


| ] Standards and mechanisms are in place to ensure that the individual has capacity to give 
consent. 


— Continue to Question 5 
| NO (For Third Party Trade information only) 
4.4 Dx] The personal information necessary for the program or activity is not collected directly from ) 
| the individual. It is collected indirectly, for example, from another program within the CBSA, © 
or from another institution, government or third party. | 


— Continue to Question 5 


) Is personal information collected indirectly from another source with the informed consent of the 
individual to whom it relates, or from a person authorized to act on behalf of the individual 
pursuant to section 10 of the Privacy Regulations? 


Statutory reference: Sections 4 and 5 of Privacy Act and section 10 of Privacy Regulations 


Policy reference: Sections 6.1.1, 6.2.6 and 6.2.9 to 6.2.13 of Directive on Privacy Practices 
and sections 6.1.2 and 6.4.1 of the Directive on Social Insurance Number 


YES 


5.1 [x] The notice and consent requirements stated at Question 4 apply. Please provide the "Privacy 
Notice" and/or "Consent Statement" below: 2 


52 | | AND, implement controls and procedures to ensure the CBSA keeps a record documenting 
whether or not an individual provided consent when it was sought, including a record 
documenting any withdrawal of consent when applicable. 


In our privacy notice which TCPs must accept, we are advising them to show the notice to the 

third parties they deal with. We cannot manage this because we do not know who the 
third parties are until the trade document arrives, also the volumes would be too high to 
manage. 
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.5.3 | | AND, if information is being collected from persons authorized to act on behalf of minors, 

| incompetents or individuals who have been deceased for less than 20 years, implement 
appropriate mechanisms to ensure that such persons are authorized to act on behalf of 
individuals who do not have the capacity to provide consent. 


— Continue to Question 6 
| NO 
5.4 [|] — Continue to Question 6 


- Is personal information collected from another source without notice to or consent from the 
individual to whom the information relates? 


Statutory reference: Sections 4, 5, 7 and 8 of Privacy Act and section 10 of Privacy 
Regulations 

Policy reference: Sections 6.2.6 and 6.2.9 to 6.2.13 of Directive on Privacy Practices, - 
section 6.2.15 of the Policy on Privacy Protection and sections 6.3.2 and 6.3.3 of Directive on 
Privacy Impact Assessment | 


YES 


) 6.1 [_| Where information is collected indirectly under any of the following circumstances without ) 
notice to, or consent from, the individual to whom it relates, please check the applicable boxes 
and explain as requested: : 


| | a) The collection is a result of a disclosure to the CBSA under subsection 8(2) of the 
Privacy Act. State the applicable paragraph(s) of subsection 8(2) and provide a brief 
explanation for each: 


| Details: 


| | b) Direct notification of the individual might result in the collection of inaccurate 
information, or might defeat the purpose or prejudice the use for which the 
information is collected. Briefly explain why notice is not provided: 


Details: 


| |с) The information involved in the program or activity is to be used solely for a non- 
administrative purpose in which no decisions are made about the individuals to whom 
' the information relates. 
6.2 [_] AND, if any of the circumstances in a) b) or c) is applicable, ensure that it is reflected in the 
/ relevant PIB. 
` 6.3 | | AND, if the information is to be used solely for a non-administrative purpose (box c above 
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has been checked), ensure that the requirements under sections 6.3.2 and 6.3.3 of the 
Directive on Privacy Impact Assessment have been met, and that the decision of the official 
responsible for section 10 of the Privacy Act to proceed with a CBSA PIA for the program or 
activity has been adequately documented in the description of the program or activity in 
"Section I - Overview and PIA Initiation" of the CBSA PIA. 


` 6.4 |_| OR, if none of the circumstances in a) b) or c) is applicable, then the personal information 

| must be collected directly from the individual, or indirectly with the consent of the individual. 
Please review the responses to Questions 4 and 5 and ensure that the "Privacy Notice" or the 
"Consent Statement" includes all of the required elements within Question 4. 


— Continue to Question 7 
NO 


6.5 [<] All personal information is collected directly from the individual to whom it relates, 
or from another source with notice to, or consent from, the individual or a person authorized 
to act on behalf of the individual (see Questions 4 and 5 above).— Continue to Question 7 


Has Library and Archives Canada approved a records retention and disposal schedule that applies 
| to the personal information? 


Statutory reference: Section 12 of Library and Archives Canada Act, sections 6, 10 and 11 
of Privacy Act and section 4 of Privacy Regulations 


Policy reference: Sections 6.1.3, 6.2.11 to 6.2.13 and 6.2.23 of Directive on Privacy 
Practices 


YES 


7.1 [ | Please identify the Record Disposition Authority (RDA) and describe the retention and 
: disposal schedule: 


Details: An RDA is currently in development. It is expected to be completed by March, 
2014. The retention period for commercial information is expected to be 15 years. 


) 7.2 | AND, implement controls and procedures to ensure that personal information used to n a 

| decision that directly affects an individual will be retained for a minimum of two years after 
the last administrative action or, where a request for access to the information has been / 
received, until such time as the individual has had the opportunity to exercise all his/her rights 
under the Act. | 


7.3 | ] AND, if the CBSA intends to dispose of personal information that has been used for an 

| administrative purpose prior to the expiration of the two-year minimum retention standard 
established by the Privacy Regulations, it must obtain the consent of the individual to whom 
the information relates before doing so. 


7.4 |_| AND, the CBSA must cite the RDA number, the retention period and the disposition 
standards for the personal information in the relevant PIB. 


— Continue to Question & 
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7.5 |_| Provide a Records Disposition Submission to Library and Archives Canada describing the 

) records containing the personal information for which the institution requires a RDA. 

7.6 | | AND, obtain a RDA from Library and Archives Canada to allow the CBSA, under certain 

' conditions, to dispose of records that по longer have operational utility for the program or 

| activity. 

- This is in progress by Information Management and will be complete by end of fiscal (March 2014). 


11 AND, ensure that all the other applicable requirements listed under "YES" at Question 7 are 
| met. 


— Continue to Question 8 


. Will measures be adopted to ensure that personal information used by the CBSA for an 
administrative purpose is as accurate, up-to-date and complete as possible? 


Statutory reference: Sections 6, 10 and 11 of Privacy Act and sections 10 and 11 of Privacy 
Regulations | 


Policy reference: Sections 6.1.1 and 6.2.9 to 6.2.16 of Directive on Privacy Practices 
YES 


n 1 [X] Please check any of the following measures that will be adopted to ensure accuracy of the 
| personal information and provide details as requested: 


8.1.1 [X] Personal information will be collected directly from the individual to whom it relates or it 
will be validated with the individual or a person authorized to act on behalf of the 
individual. 


8.1.2 DX] A information-matching process will be used to verify the accuracy of personal 
information against a “reliable source” (within or outside the CBSA) where this 15 
authorized, or where consent was obtained. 


/ Details: 


As CBSA receives the Shared Secret applications from carriers with existing carrier 
codes, the information will be verified against all the information that is contained in 
the existing “Daryyl” database, as well as associated carrier application documents 
that can be accessed through Daryyl (i.e.: Carrier Code Application). 


Аз рег the Portal Terms and Conditions, the Account Owner will be responsible 0 
_ keeping the associated Business Account information with the CBSA up-to- -date and 
must notify the CBSA immediately upon any change to the business name, addres 
and/or contact information. The Account Owner must notify the CBSA immediately _ 
| upon any change to its corporate structure or organization under federal or provincial — 
_ OPO or Eas IGEISIGHOR which may result in the CBSA EURE that — 
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8.1.3 Е In cases where direct collection or consent is not feasible, the CBSA will obtain 
information from trusted sources (public or private) and verify accuracy against existing 
personal information before use. 


Details: 
Address fields for which codes are used such as provinces or countries will b 
. verified against information tables in the ACROSS system. The syntax (alpha 
numeric and field size) on these fields will also be checked and the message will be 
p ected back to the client for amendment if it is incorrect. 


8 2 AND, if measures are adopted other than "direct collection or validation with the individual 
or with a person authorized to act on behalf of the individual", the CBSA must implement 
appropriate controls and procedures to ensure that: 

a) the technique(s) and the specific source(s) used to validate or update the personal 
information are documented; 

b) individuals are given the opportunity, whenever possible, to request correction of any 
inaccurate personal information before the information is used in a decision-making 
process that affects them; 

C) personal information can only be modified or corrected by those within the CBSA who 
have the authority to do so; 

d) when personal information is corrected or annotated, the record of personal information 
indicates the date of the last correction or annotation and the source of the information 
used to make the correction or annotation; and 

d) when personal information is corrected or annotated, other authorized holders of the 
information are notified about the correction or annotation and that all copies of the 

2 information in the possession of the CBSA are corrected / annotated. 

8 3 L] AND, if appropriate, ensure that the “Privacy Notice" or “Consent Statement" and the 
relevant PIB are amended to identify the information-matching activity including the 
source(s). 


— Continue to Question 9 
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be verified because it will not be used. It is trapped at the earliest point in the 
transmission chain and is not sent to ACROSS for validation with the rest of the 
conveyance submission. Instead crew information will be archived on tape for 7 years. 


In Build 3 of eManifest, crew information will be mandatory. At that time it will be 
| verified and risk assessed with the rest of the conveyance submission. 


Will the personal information collected for the program or activity be used solely for the original 
purpose for which it was obtained or compiled, a use consistent with that purpose, or a purpose for 
which the information was disclosed to the institution pursuant to subsection 8(2) of the Privacy 

` Act? 


Statutory reference: Sections 5 and 7 to 11 of Privacy Act 


Policy reference: Sections 6.1.1, 6.1.9, 6.2.9 to 6.2.13 and 6.2.17 of Directive on Privacy 
Practices, section 6.2.15 of Policy on Privacy Protection and Section IV of Appendix C of 


Directive on Privacy Impact Assessment 
: 9.1 Dx] Implement controls and procedures to ensure that access to the personal information for such ) 
| purposes will be limited to authorized individuals who need to know the information to 
) perform their official duties. 
: ACROSS access is granted by manager approval, only to people who need it for their work. 
: EDWE has access controls in place to ensure that a user is only afforded the ability which relates only | 
to his/her specific position. For example, an individual must first seek approval from the Functional — 
Authority of the EDWE (Director), obtain a license for a particular toolset (Cognos), then is granted 
| access through a user ID and password only to the tables/information that were specified in the initial 
request. Also, the information therein is partitioned to facilitate the availability of divergent 
information views, which denote specific sets of information. The PAA only allows 30 Portal 
Administrators to review and access all user profiles and preferences, for the purpose of ensuring the 
health of the Portal and assist users, approximately 
9.2 [x] AND, ensure that the “Information Flow Diagram" or “Information Flow Tables” completed 
for “Section 4 — Flow of Personal Information” of the CBSA PIA identify the areas, groups 
and individuals (e.g., the positions) within the CBSA who have a need-to-know to access to or 
handle the personal information, including their geographical location and where the personal — 
information will be stored or retained. 
/ 9.3 [x] AND, if the purposes for which the personal information is used includes any use(s) of the 
information for a non-administrative purpose, (such as research, statistical, audit and 
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evaluation purposes) the CBSA will adhere to the requirements and principles in the CBSA 
Privacy Protocol For Non-Administrative Purposes (2012), in accordance with section 


6.2.15 of the Policy on Privacy Protection, to address any impact that such non-administrative ) 


uses may have on privacy. 
— Continue to Question 10 


NO 

9.4 [| Identify below any other uses of the personal information, in other words, any routine uses 

| that are not directly related to the purpose of the collection, or, which are not consistent with 
that purpose or for which the information was disclosed to the CBSA pursuant to subsection 
8(2) of the Privacy Act: 


9.5 Bi AND, ensure that these other uses are reflected in the relevant PIB. 
9.6 | | AND, include a description of these other uses in the “Privacy Notice" or “Consent 
: Statement”, as appropriate, 
|_| AND, ensure the all the other applicable requirements listed under “YES” at Question 9 are 
met. 


— Continue to Question 10 


Will personal information be disclosed for purposes directly related to the administration of the 
program or activity? 


Statutory reference: Sections 5 and 8 to 11 of Privacy Act. 
Policy reference: Sections 6.2.10, 6.2.11 and 6.2.13 of Policy on Privacy Protection, 


sections 6.2.1 to 6.2.3 of Directive on Social Insurance Number, sections 6.1.9, 6.2.9 to 6.2. 13 


and 6.2.15 to 6.2.20 of Directive on Privacy Practices and section IV of Appendix “C” of 
Directive on Privacy Impact Assessment ) 


Also see "Guidance for Preparing Information-Sharing agreements Involving Personal 
Information” and “Taking Privacy into Account Before making Contracting Decisions 
YES 
10. 1 [X] Please check all applicable boxes below and, for each disclosure, identify the name of the 


organization or third party to which personal information will be disclosed. If it is disclosed 


within the CBSA, please identify the branch and the program or activity. 
10.1.1 >] Within the CBSA for another program or activity 


. Detail: 
Commercial Operations, ACI Policy Unit (Compliance Monitoring), Intelligence, 
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. Detail: - 
: The CBSA will not share this 
freight forwarder sends their 
have it automatically sent to : 
operator through the Manifes 


1 the private sector. However, when a 
ation to the CBSA they can elect to 
r, Carrier, broker or warehouse 

ice that the CBSA offers. 


When a Compliance Monitoring Officer (ACI Policy Unit) determines that a delivery - 
address submitted by a TCP is incorrect, they send it back to the carrier. However __ 
this information is only being sent to the person from whom it was received. It is not 
being shared with a different TCP. 


a0 2 Dx] AND. ensure that: 


a) any such disclosure is made in compliance with section 8 of the Privacy Act, which allows 
disclosures of personal information with consent of the individual to whom the ! 
information relates (subsection 8(1)) or without consent in certain and limited 
circumstances pursuant to subsection 8(2) of the Act; 


b) only personal information elements that are necessary for the intended purpose are 
disclosed; 
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c) the organization or third party receiving the personal information is authorized to do so; 


d) administrative, physical and technical safeguards appropriate to the sensitivity of the 
information will be applied to protect the information during and after its transmission 
(see Question 15); 


e) the organization or third party to which the personal information will be disclosed for the 
administration of the program or activity are identified in the *Consistent Use" section in 
the relevant PIB in CBSA Info Source, including the specific purpose of the disclosure; 


the “Privacy Notice" or “Consent Statement" describes any disclosures of information; 
and, 


f) the "Information Flow Diagram" or “Information Flow Tables” completed in “Section 4 — 
Flow of Personal Information” of the CBSA PIA include details on the disclosed personal - 
information: | 


10.3 PX] AND, any disclosure of personal information to another federal institution or outside the 

| Government of Canada is governed by a formal agreement or arrangement (e.g., a 
Memorandum of Understanding, an accord, a contractual arrangement, etc.) to ensure that 
appropriate privacy protection clauses are included, and, where applicable, include provisions 
for inter-jurisdictional or transborder flows of personal information. Such clauses must cover 
the following topics: 


a) Control over personal information, where appropriate. 
b) Limitations on the collection, retention, use and disclosure of personal information. 


c) Measures (administrative, technical and physical) to protect the integrity and 
confidentiality of personal information. 


d) Measures governing the disposition of the personal information, where relevant 


e) Measures to ensure or verify that the personal information is only used for the purposes 
related to the agreement, arrangement or contract. 


f) Obligations are to be extended to other parties such as subcontractors. 


— Continue to Question 11 


NO 


) 10.4 [|_| There is no disclosure of personal information within or outside the institution for purposes 
that are directly related to the administration of the program or activity. 


— Continue to Question 11 


Will controls and procedures be implemented to account for any new use or disclosure of the 
personal information that is not included in the relevant PIB published in CBSA Info Source? 


Statutory reference: Sections 7 to 11 of Privacy Act and section 4 of Privacy Regulations 
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YES 
11.1 [X] Appropriate controls and procedures have been or will be implemented to ensure that: 


a) the head of the institution (The ATI and Privacy Director) or the appropriate delegate is — 
notified about any new use or disclosure of personal information that is not reflected in the | 
PIB description published in CBSA Info Source; : 


The eManifest project area will call or email ATIP to inform them of any new use or disclosure not 
reflected in the PIB. 


b) the consent of the individual to whom the information relates is obtained in writing, as 
appropriate, prior to any new use of the information for an administrative purpose that is 
not reflected in the relevant PIB published in CBSA Info Source, unless the new use is 
considered to be consistent with the purpose for which the personal information was 
obtained or compiled and the Privacy Commissioner is notified, by the CBSA ATI and 
Privacy Director, forthwith regarding the new consistent use; 


C) except as permitted under subsection 8(2) of the Privacy Act, any disclosure of personal 
information for a purpose that is not reflected in the relevant published in CBSA Info 
Source will only be made with the consent of the individual to whom the information 
relates; 


d) arecord is kept for any new use or disclosure of personal information not described in the 
relevant published in CBSA Info Source, and that this record is stored with the 
personal information to which it relates and retained for a minimum period of two years 
following such a use or disclosure; 


e) if the information is disclosed to a federal investigative body under paragraph 8(2)(e) of 
the Privacy Act, the record of disclosure will be kept in a separate PIB for a period of two 
years where it will be available to the Privacy Commissioner for review upon request; 


f) the Privacy Commissioner is notified, by the CBSA ATI and Privacy Director, forthwith, 
as required under subsection 9(4) of the Act, of any new use or disclosure that is 
consistent with the purpose for which the information was obtained or complied, but 
which is not reflected in the relevant PIB published in CBSA Info Source; 


g) the relevant PIB is amended in time for the next edition of CBSA Info Source to include 
any new use(s) or disclosure(s) that are consistent with the purpose for which the 
information was obtained or compiled, as well as any routine use(s) or disclosure(s) that 
do not fall within the categories of purpose of collection or consistent use; and 


h) the Privacy Commissioner is notified, by the ATI and Privacy Director, prior to or 
forthwith, as required under subsection 8(5) of the Act, about any disclosures made or to 
be made in the public interest or in the interest of the individual to whom the information 
relates. 


Detail : A PIB has been created for eManifest which contains all of this information. ) 
It will be registered with TBS when the PIA is submitted. 
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— Continue to Question 12 
NO 


Has a Statement of Sensitivity (SoS) or similar analysis been completed to assess the degree of 
sensitivity of the personal information to be collected and retained for the program or activity? 


Statutory reference: Sections 7 and 8 of Privacy Act. 


Policy reference: Appendix C of Directive on Privacy [Impact Assessment and sections 
6.2.17 to 6.2.21 of Directive on Privacy Practices, Policy on Government Security, 


Operational Security Standard: Management of Information Technology Security (MITS 


YES 
12.1 [X] The information contained in the SoS or similar analysis has been taken into account when 
: assessing the level of risks to privacy in "Section 2 - Risk Area Identification and 
Categorization" of the CBSA PIA. 
— Continue to Question 13 
NO 


) 12.2 [_] Please explain why a SoS or similar analysis was not considered necessary to assess the 
: sensitivity of the information. 


Has a Threat and Risk Assessment (TRA) or a similar security assessment been completed for the 
program or activity? 


Statutory reference: Sections 7 and 8 of Privacy Act. 


Policy reference: Appendix C of Directive on Privacy Impact Assessment and sections 
6.2.17 to 6.2.21 of Directive on Privacy Practices, Policy on Government Security, 
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Operational Security Standard: Management of Information Technology Security (MITS) 
YES 


) 13.1 [X] Reference the title of the TRA or other security assessment in “Section 6 — Supplementary 
Documents List’ and provide a brief synopsis of the assessment in the space below: 


13.2 [x] AND, obtain assurances from the officials responsible for the program or activity that the 
) measures recommended in the assessment have been implemented to ensure the 
confidentiality, availability and integrity of the personal information. 


13.3 [<] AND, ensure that any residual risks to personal information are known and accepted by the 


executive or senior official responsible for the program or activity and the Head or delegated 
authority for the Privacy Act. (ATI and Privacy Director) 


— Continue to Question 14 
NO 


| 13.4[_] If a TRA or similar security assessment is underway, simply reference that fact in the space 
' below and indicate when it is likely to be completed. If there is no intent to complete опе, 
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ds - Administrative, Physical and Technical 


) Please identify below any administrative, physical and technical safeguards in place, or to be 
implemented, for this program or activity to ensure the confidentiality, availability and integrity of 
the personal information. 


Statutory reference: Sections 7 and 8 of Privacy Act 


Policy reference: Appendix C of Directive on Privacy [Impact Assessment and sections 
6.2.17 to 6.2.21 of Directive on Privacy Practices, Policy on Government Security, 


Operational Security Standard: Management of Information Technology Security (MITS 


Please check all that apply, including safeguards identified by the TRA or similar security 
assessment. 


14.1 Administrative safeguards 

Internal security and privacy policies and procedures 

Staff training on privacy and the protection of personal information 

Screening and security checks of employees 

Appropriate security levels for employees who will have access to personal information 


Xx] XI P3 DA Xx 


Contingency plans and documented procedures in place to identify and respond to 
security and privacy breaches, and to communicate security violations to the information 
subject, law enforcement authorities and relevant program managers 

Regular monitoring of users’ security practices 


[X] Methods to ensure that only authorized personnel who need to know have access to 
personal information 


| Detail: 

| Employees must have security checks. In order to access the systems referenced in 
this document (with the exception of DARRYL), they must obtain approval from 

_ their manager and are then given a user ID and password to access the system. 


taff are trained on privacy and the protection of information. 
The EDWE has access controls in place to ensure a respective end-user is afforded 
the ability to view information which relates only to his/her specific position. 
pe се has a privacy breach protocol \ which can be found at the following link 
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14.2 Physical safeguards 
[x] Restricted access areas 
| ] Security guards 
[X] Identification badges are worn by staff at all times 
[<] After hours alarms and monitoring systems 
[X] Locked filing cabinets 
| | Combination locks 
| | Safes 
| | Cipher locks 
[X] Key cards 
| ] Video surveillance (closed-circuit television) 
DX] Secured server locations 
[X] Backups secured off-site 


Detail : 


| Information stored on tape at the CECP 15 stored in a locked room which only 12 
/ people can access through sign-in and approval. 


| The ACROSS system can only b d through the CBSA network. 
| CECP, ACROSS, PAA, the Port; WE is in a secure server location. 
Employees need key cards to acc s in CBSA buildings. 


14.3 Technical safeguards 
bx] Role-based user authorization and authentication 
| | Biometrics 
[X] Passwords (minimum of 6 characters long, include alpha and numeric characters) 


[X] Passwords are changed by users every 90 days and recently used passwords cannot be re- 
used) 


[X] Password protected screensavers 


Session-time out security (automatically locks an account after a session has been idle for ) 
a specified amount of time) : 


D Firewalls 

D Intrusion Detection System (IDS) 

[X] Virtual Private Network (VPN) 

[Х| Encryption of sensitive information (PORTAL ONLY) 

| | Government of Canada Public Key Infrastructure Certificates (PKI) 
| ] External Certificate Authority (CA) 

х] Audit trails 
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и: 


fth 


nformation collected 
tto ACROSS. 


viewed by a user. 


Portal does track the specific inform 


- Portal Registration Informati 
. The Account Owner or Pro» 
00 their business account. T 

address from the user. The A 


as control over which users are added - 
e URN, family name and email : 
| ters these three information elements 
and then the eManifest Portal dı atching first name, last name and email 
address of the associated user. К. match on three information elements in 
order to add a user to the account prevents a user who has not provided their | 
information to an Account Owner or Proxy Account from being added to the account. 


/ The Account Owner/ Proxy Account Owner has access to first name, family name, _ 
/ email address, telephone number, telephone extension, URN, user role of each user in | 
their business account There is little risk involved with this as the user knows this | 
information will be shared when he provides the Account Owner or Proxy Account 

with the initial 3 pieces of personal information. 
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tracking technologies to collect personal information about users and their transactions? 


Statutory reference: Sections 4 to 10 of the Privacy Act and section 4 of Privacy 
Regulations 
Policy reference: Subsections 6.1.1, 6.1.3, 6.1.9, 6.2.9 to 6.2.13, 6.2.17 and 6.2.23 of 
Directive on Privacy Practices 
| YES 
15.1 [X] The specific tracking technologies to be used is adequately described under Part 6: 
Technology and Privacy of “Section 2 — Risk Area Identification and Categorization” of the 
| CBSA PIA; 
15.2 [X] AND, the collection of any personal information using such technologies is reflected in the 
relevant PIB and in “Section 3 — Analysis of Personal Information Elements" of the CBSA 
| PIA; ) 
15.3 [X] AND, the use of such technologies to collect information about users and their transactions is 
adequately reflected in the "Privacy Notice"; 
15.4 [<] AND, those responsible for implementing and using tracking technologies to collect personal 
! information or who may have access to personal information collected through these methods 
| are made aware of privacy and security policy requirements; 
) 15.5 [|_| AND, where personal information collected through such tracking technologies is used to 
make a decision that directly affects the individual to whom the information relates, it will be 
retained for a minimum of two years after the last administrative action as required under the 
Privacy Regulations. 
Cookies are not relied upon for tracking personal info about users. We use the ID and 
URN for the portal user for this. 


— Continue to Question 16 
) NO 
| 15.6| | Tracking technologies are not used to collect personal information about users. 


— Continue to Question 16 


) Will the new or modified program or activity result in new or increased surveillance or monitoring 
| of a targeted population ? 


Statutory reference: Sections 4 to 10 of Privacy Act, section 4 of Privacy Regulations and 
section 8 of the Charter of Rights and Freedoms 


Policy reference: Subsections 6.1.1, 6.1.9, 6.2.9 to 6.2.13 and 6.2.17 of Directive on 
Privacy Practices 


YES 


| 16.1[ | Consult with your legal advisors to determine whether or not such surveillance or monitoring | 


activities raise any issues relating to the Charter of Rights and Freedoms, the Privacy Act or 
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| other applicable acts. 

16.2 [_] And, ensure the surveillance or monitoring method(s) to be used, the characteristic(s) of the 
targeted population and the scope of the surveillance or monitoring are adequately described 
under Part 6: Technology and Privacy of “Section 2 — Risk Area Identification and 

| Categorization” of the CBSA PIA. 

) 16.3 [|_| AND, any personal information collected or created as a result of such surveillance or 

' monitoring is described in the relevant РІВ and in Section 3 — Analysis of Personal 

| Information Elements” of the CBSA PIA. 

16.4 [| AND, the collection or use of personal information through surveillance or monitoring is 
adequately reflected in the "Privacy Notice", unless such notification might result in the 
collection of inaccurate information or defeat the purpose or prejudice the use for which the 
personal information is collected. 


|_| If notice about surveillance or monitoring will not be provided 


Detail explain why: 


16.5 [| | AND, those responsible for implementing and using such surveillance or monitoring 
| method(s) or who may have access to personal information collected or created through these 
methods are made aware of privacy and security policy requirements. 


— Continue to Question 17 


- NO 
16.6 [<] The new or modified program or activity will not result in surveillance or monitoring. 


— Continue to Question 17 


Does the program or activity involve compliance/regulatory investigation or law enforcement, 
surveillance or intelligence gathering that targets specific individuals against whom penalties, 
criminal charges or sanctions may be applicable? 


Statutory reference: Sections 4 to 10 of Privacy Act, section 4 of Privacy Regulations and 
section 8 of the Charter of Rights and Freedoms 

Policy reference: Subsections 6.1.1, 6.1.9, 6.2.9 to 6.2.13 and 6.2.17 of Directive on 
Privacy Practices 


) YES 

) 17.1 |_| Consult with your legal advisors to determine whether or not the compliance/regulatory 
investigation or law enforcement activities raise any issues relating to the Charter of Rights 
and Freedoms, the Privacy Act or other applicable acts. 

/ 17.2 [4 AND, identify the legislative authority and the specific regulatory or law enforcement 

2 purpose involved: 
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Detail: This information is part of existing compliance programs, the only difference is 
that the information is now being received electronically and in advance. 


17.3 [X] AND, if the legislative authority differs from the legal authority for the program or activity, 
ensure it is adequately reflected in the response to Question | of “Section 5 — Privacy 
Compliance Analysis” and in “Section 1 — Overview and PIA Initiation “of the CBSA PIA. 


) 17.4 KÎ AND, any personal information collected or created as a result of such regulatory or criminal - 
! enforcement, surveillance or intelligence gathering program or activity 1s described in the 


relevant PIB and in “Section 3 — Analysis of Personal Information Elements” of the CBSA 
PIA. 


17.5 [X] AND, the collection or use of personal information through these compliance / regulatory 
! investigation or enforcement activities is adequately reflected in the "Privacy Notice", unless 


such notification might result in the collection of inaccurate information or defeat the 
purpose, or prejudice the use, for which the personal information is collected. 


| | If notice about the compliance/regulatory investigation or law enforcement activities will 
not be provided. | 


NO 


17.6| | The program or activity does not involve the conduct of regulatory or criminal enforcement, 
: surveillance or intelligence gathering. 
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| SECTION 6 - Summary of Analysis and Recommendations 


Identified Risk Level Mitigation 
of Risk 


Lack of necessity to collect crew 
information 


In the EDI highway conveyance 
submission, some TCPs (highway 
carriers and service providers) are 
submitting crew information even 
though the CBSA does not currently 
have the regulatory authority to collect 
this information and this information 
will not be necessary to a program 
activity until 2014. The risk is that the 
agency is collecting and storing 
personal information for which it has 
no authority. 
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Low 


Crew information received electronically 
in the highway conveyance report is 
currently not used by CBSA. The crew 
information elements are being trapped at 
the earliest possible point in the 
transmission chain and retained and stored 
for 7 years off-line on archival information 
tapes. For legal reasons, all electronic trade 
data received by the CBSA must be stored 
on these tapes in the format it was received 
for 7 years. 


The Agency has published client 
documentation stating clients are not to 
submit crew information until required to 
do so. 


The Agency has taken steps to protect the 
crew information 


For information integrity and 
completeness, no part of the received 
information, including crew information 
can be modified or deleted from the 
original transmission. 
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Notification of Collection of Third 
Party Information 


Carriers, freight forwarders or service 
providers submit information on 
behalf of third parties to the CBSA. A 
PNS is provided to the carrier, freight 
forwarder or service provider at time 
of registration, which stipulates that 


the notice must be shared with all 
third parties. However, the CBSA has 
no way to verify that these third 
parties have been provided with the 
notice and therefore understand the 
use, retention and disclosure of their 
personal information. 
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This same crew information is collected by 
existing CBSA programs in paper format 
upon arrival and the agency has regulations 
to support this. 


TCPs will be asked to share the CBSA’s 
Privacy Notice Statement with these 
parties so that they are aware that their 
information is being sent to the CBSA, its 
uses, retention, and disclosure. 


Portal clients will view this PNS as part of 
the Portal terms and conditions, which they 
must accept when they sign onto the 
Portal. 


EDI clients will be provided with the PNS 
as part of the paper-based registration 
process. 


The PNS will also be emailed to clients as 
an electronic bulletin. 
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See Risk #1 for 
additional info. 


| SECTION 7 - SUPPLEMENTARY DOCUMENTS LIST 


List all supplementary documents that support the conclusions of this CBSA Privacy Impact 
Assessment. For each document, cite the specific sections of the documents (subject, chapter, 
page, paragraph, etc.) that correspond with the CBSA PIA and link them to the PIA sections. 


Document Reference PIA Reference 


Privacy Notice Statement for the | Whole Document 
Portal 


Privacy Notice Statement EDI Whole Document 


CB SA Information Management | 
Policy 
CBSA Privacy Breach Protocol Section 14.1 


Directives for the non- Whole Document Whole Document 
administrative Use of Personal 
Information 


Service | Service Standards — Email | Whole Email — — Email 


Privacy Act Section 8 CT ИННИ! C — 8 Ли 8 
of Information 
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Canada Border Services Agency/ Advance Commercial Information / eManifest Bulld 1 - PIA 


| SECTION 8 - FORMAL APPROVAL 


) The following signature represents a 
commitment to comply with sections 4 to 8 of 
Һе Privacy Act and the related privacy policy 
requirements outlined in the CBSA PIA as 
_they relate to the administration of the 
identified program or activity. 


Signature of CBSA Vice President lead for 
program or activity 


) Date 


| Note: Responsibility for sections 4 to 8 of the 
| Privacy Act rests with all employees of 
government institutions that handle personal 
information. Officials who manage such 

| programs and activities are responsible for 
ensuring that such requirements are 
implemented as part of the administration of 
_the program or activity. 


The following signature represents a 
commitment by the Head of the institution or 
his/her delegate(s) who is responsible for 
establishing personal information banks in 
accordance with section 10 of the Privacy Act. 


signature of CBSA ATI and Privacy Director 


Date 


Note: Under the Privacy Act, the Head or 
his/her delegate(s) is responsible for 
complying with legal and relevant privacy 
policy requirements related to the approval 
and registration of personal information banks 
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Canada Border Agence des services 


frontaliers du Canada 


Predictive Analytics 


Classification of Travellers by Risk Type 


Targeting Data Analytics 
2015-10-19 
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з KS "Ss SS SS KK A = 


Outline 


What is Predictive Analytics and Why it is important 
Predictive Analytics’ structure 

Example — Classification of Travelers by Risk Type 
Methodology - leveraging best practices 

Predictive models and their related accuracy rates 
Preliminary predictive model results 

Summary of the results 


Existing challenges 
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What is Predictive Analytics? 


It is the process of discovering patterns in past behavior to predict the outcome 
of future cases 
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Why it is important? 


In the past - decision making process could be: 
— Subjective 
— Time consuming to perform quality assurance 
— Less consistent across the entire organization 
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Why it is important? 


Where we are now — many decisions that affect operations are left to the ‘gut’, leaving enormous 
opportunities in the age of Predictive Analytics 
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Why it is important? 


In the future — decision making process should be: 
— Quantitative 
— Evidence-based 
— Transparent 
— Easily verifiable 
— More easily adjusted to meet new challenges and requirements 
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Predictive Analytics’ structure 


e Тһе scope of analytics is expanding considerably as human behavior is modeled and expressed 
mathematically 


° Predictive Analytics adds a new level of analytics maturity and takes decision making a step further. 


Data warehouse & 


Math & Stats Data Mining 


Applications 


Software Tools Business Intelligence 


Data Scientists 


Business Analysts Executives Operations 


Anticipate what is about to take place (predictive analytics) Understand what is taking place (BI) 
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Predictive Analytics Advantages 
Y  *..the science of gathering the dots [the data] married with the art of connecting the dots" 


v Using machine learning algorithms and statistical techniques for pattern recognition 


Pattern Recognition Algorithms 
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Classification of Travelers by Risk Type 
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Protected B 


Develop Predictive Models 
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Machine learning models selected 


Decision Trees and Logistic Regression predictive models 


Logistic Regression — Logistic regression, also Known as nominal regression, Is a Statistical 


technique for classifying records based on values of input fields. It is analogous to linear 


regression but takes a categorical target field instead of a numeric one. 
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Classification of Travelers by Risk Type 
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Protected B 


Develop Predictive Models 
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Develop Predictive Models — decision tree example 
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Protected B 


Develop Predictive Models — sample statistics 
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Summary — Classification of Travelers by Risk Type 


v 2 different prediction methodologies — logistic regression and decision trees (CHAID) 


v Both models provide relatively similar results and also simple to implement 


Next st 


or exploring other possible predictive modeling approaches. 
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Existing challenges 


4 — Software limitations — only available modelling software to us is SPSS Modeller. We require second 


software tool to validate and perform quality assurance of SPSS Modeller output. We also need 


additional machine learning modeling solutions for improving risk assessment which currently do not exist 


їп SPSS. SPSS Modeller is limited and its capacity could be improved by combining with other software. 
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National 
Targeting Centre 


Data Analytics 
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Data Analytics at the National Targeting Centre 


The CBSA National Targeting Centre (NTC) is using data 
analytics to support its mandate to support pre-arrival risk 


assessment through. * Generating intelligence & 


investigative leads; 


• Strengthening & testing 
ocenarios and Risk 
Indicators; 


e Acquiring tools & developing 
methodologies to push 
analytics to front line users 
(targeting & intelligence 


officers). 
) Protected B 
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Combining Technical & Business Knowledge 


e The NICs Data Analytics unit has a combination of IT 
specialists, CBSA employees with mathematics, science 
& engineering backgrounds, as well as CBSA employees 
with essential business experience (targeting & 
intelligence) all working together to further the NTC's 
capabilities. 


* The colocation of these individuals allows for continuous 
brainstorming, theory testing, and a rapid development 
environment where projects are run with targeting 
operations to determine the validity of ideas, 
methodologies and tools. 
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What is the data telling us? 

- Business Problems 

- Investigations 

- Intelligence Files 

- Trend Analysis 

- Project Planning & 
Support 
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Intelligence Reporting 
Open Source 
Intelligence 

CBSA Data Partner 
Data 

External Data 

Third Party Data 


SPSS Modeller 
[2 

SAS 

Social Media 
Geospatial 


.. Analytical 
Methodologies 
& Tools 


Lead Generation 
Reporting 

Project Support 
Analytical Report 

Risk Indicators 
ocenario Development 
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Joint Projects & Initiatives 


Joint Projects are 


underway & planned to: 


— Benchmark tools, data and 
methodologies 


Share information 
Mitigate joint issues 
Advance investigations 
Generate leads 


ION + SERVICE - INTEG 


RÉ 
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Data Analytics — Adding Value to the NTC & CBSA 


Leveraging data 
analytics 
increases the 
effectiveness 
and efficiency of 
CBSA 
operations. 
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Canada Border Agence des services 


Services Agency frontaliers du Canada 


Predictive Model 
Methodology 


Targeting Data Analytics 
June, 2016 
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What is Predictive Analytics ? 


It is the process of discovering patterns in past behavior to predict the outcome 
of future cases 
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Building a predictive model — our methodology 
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Objective 


— Develop a model for predicting risk of contraband in commercial shipments 


— Share the methodology with B5 Partners 
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Data Analytics within the CBSA 


Highlights: 
e CBSA has made significant investments in Business Intelligence 
and Advanced Analytics 


e Significant progress has been made in strengthening Data 
Governance and improving both data quality and data integrity 


e CBSA has extended capabilities in front-line operations, program 
management, as well as science and engineering research. 


Lessons Learned: 


* The need to take an enterprise approach to Data Analytics, which 
looks at managing data as an asset 

e Developing a new strategy that integrates Business Intelligence, 
Data Governance and Advanced Analytics 
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Data Analytics within the CBSA 


Science and Engineering Lab 


e The Lab work on developing new methodologies and advanced analytics 
strategies in support of various projects across the CBSA. 


Program Management 


e Support the alignment and oversight of varying data analytics initiatives 
within the CBSA 


e Integrating Reporting project is being integrated by Programs to build the 
Integrated Data Warehouse (IDW) which will provide insight into the ‘single 
version of the truth on the Agency's per 


National Targeting Centre (NTC) 


e The NTC conduct operational analytics to support the identification of both 
high risk traveller and goods destined for Canada. 
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Plan for Growth 


3 year integrated plan to invest in analytics holistically 


otrengthening data and information governance by rationalizing 
investments on new technologies, while continuing to leverage 
existing investments 


Build organizational capabilities: 
— Focus on an building an analytics focused workforce 
— Change the culture by moving to a fact-based decision making process 
— Enhance Integrated Data Warehouse 


Leverage existing partnerships to develop joint capabilities 


001343 


Protected B 


Challenges and Risks 


Data acquisition: streamlining processes and expediting availability 
of data for analytics 


Managing privacy and security considerations 


Recruiting and retaining data scientists: small number in the Lab 
(R&D), NTC (targeting), programs (BI) 


Funding: coordinated approach to investment planning 
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ISSUE 
The BS is invited to engage in a three-part discussion: 


1) Sharing Experiences: Provide a presentation on their experiences, current analytics 
capacities, and challenges. 


2) Looking out to the Future: Engage in a discussion with a private sector company, IBM, on 
Ing gag pr Y 
global trends, private sector challenges, and the future of analytics. 


3) What does this mean for us? : Identify opportunities and next steps for the B5 to share 
capabilities and work collaboratively. 


EXECUTIVE SUMMARY 


The discussions on data analytics among B5 partners are still in the early stages, but all 
recognize this as an area for greater collaboration. In April 2015, the Heads of Intelligence group 
formed a Data Analytics Tradecraft Working Group with a specific intelligence-related purpose 
to increase sharing, collaboration and learning in the domain of data analytics and to leverage the 


that group, Canada hosted the first Analytics Practitioners Workshop at our National Targeting 
Centre. Also in June 2015 at the B5 Heads meeting, the B5 further 
explore the topic of “big data". They were also interested in holding meetings with the private 
sector to understand some of their approaches to collecting and analyzing large amounts of data. 


In a teleconference between the B5 Deputy Heads, December 2, 2015, 


While the Deputy Heads were keen to work collaboratively 
together and to share the burden of this large endeavor, the focus must be on those areas where 
we have similar objectives, challenges, and share a common interest. 


AGENCY POSITION 


Canada intends to share its experiences in Data Analytics with its B5 partners, in order to gain 
insights into how each agency has used data analytics to its advantage, including what lessons 
can be learned from the HINT Data Analytics Tradecraft working group. We would also like to 
express our willingness to take the chair of this group. In keeping with CBSA's Data Analytics 
strategy, however, we would like to broaden the B5 "community of practice" to include the use 
of analytics to support a wide range of program and operational objectives. 


001346 


TALKING POINTS 


1) 


2) 


Sharing Experiences (President introduces Louis-Paul Normand who will deliver 
CBSA’s presentation) 


Last fall, we introduced a new three-year Data Analytics strategy that will transform the 
Agency’s capacity for data governance, business intelligence, and advanced analytics. 


The Agency has made considerable progress in this field over the past few years, but much 
work has taken place in a “siloed” environment. As a result, we are now taking an enterprise 
approach to the way that we gather, organize and use our data. 


As part of this transformation, we look forward to working with — and learning from — our В5 
partners. By sharing our expertise, we can all take better advantage of the rapid changes 
which are taking place in this field. 


To this end, I would like to introduce Louis-Paul Normand, our Associate Vice-President, 
Information, Science and Technology. Louis-Paul has played a leading role in managing our 
major information technology projects. I would now ask him to share Canada’s data 
analytics experience. (See TAB 3A) f 


Looking out to the Future: IBM Presentation and Discussion 


If we could get risk assessment right and take advantage of other technologies (e.g. different 
sensors and communication paths) that can provide us with information in advance of a 
person or shipment reaching a Port of Entry, we would be able to determine admissibility in 
advance of the person or shipment reaching our borders. 


We would truly be pushing our ‘borders out’ and would never have to stop admissible 
travellers or shipments, unless it was for arandom check. We would not need Primary 
Inspection Line booths as we see them today and Ports of Entry would work more like what 
we know as “secondary” today (only improved I think). 


We would communicate with citizens and shippers by a variety of channels (e.g. their smart 
devices, the dash on their car, their wearable device, etc.) to signal them to stop or just 
welcome them into the country. So imagine a “zero wait time” for admissible traffic! Who 
wouldn’t want that? Arguably the Customs experience from a citizen’s perspective hasn’t 
changed much in 100 years. This would be transformational. But it is only possible if we get 
risk assessment right. That’s how important and core ‘analytics’ is to border management. 


Of course there is more than risk assessment (as the presentation shows) and we can take 
advantage of available products. Machine learning has advanced enough to be decent in 
language translation, for example — something that could be useful in a Port of 

Entry. Perhaps countries could split up the evaluation of products (not limited to language 
translation) and share results? 


Page 2 of 3 
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3) 


Imagine also Artificial Intelligence-assisted officers who have the regulations, standard 
operating procedures, or instructions they need instantly. We all know we can’t hold 
everything in our head. 


Our Science and Engineering Directorate has recently started some work in 
Robotics. Imagine the assistance a smart (analytics or AI based) robot could provide. We 
have recently started into the world of remotely operating small ports! 


One very practical point. As boring as it sounds we need to use the same lexicon when we 
talk about analysis and analytics and Artificial Intelligence. We’ve experienced lots of 
misunderstanding based on people using terms in less standard ways. Perhaps that could be 
an action item for our experts going forward. 


What does this mean for us? Open Discussion by all members 


We think the HINT Data Analytics Tradecraft Working Group has been doing good work 
since its creation. Its focus on operational intelligence and targeting issues is important, and 
we would highlight the need to confirm the chair of this working group for the coming year. 
The B5 also needs to require the group to set objectives and implement opportunities to 
advance tradecraft application and learning. Canada is willing to take this leadership role. 


In addition, as noted in the "next steps" slide of our presentation, we would support the 
formation of a broader “community of practice" or “expert network” on data analytics which 
would supplement the targeting and intelligence focus of the HINT tradecraft working group. 


We could begin by sharing contact information in our respective organizations for the lead 
players involved in data governance, business intelligence, and data analytics. We could then 


task these leads to prepare a more in-depth analysis of potential areas for co-operation. 


Working together, we will all be in a better position to address the challenges and 
opportunities posed by the rapidly changing world of data analytics. 


Page 3 of 3 
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CBSA has deployed several foundational elements of its business intellig 


analytics strategy 


~ Several new solutions have been developed with data analytics as a core component (emanifest, Entry-Exit, ILAPI} 


… . We have formalized common data services governance and delivery across the agency 
— We have launched several pilot and research projects to inform future investment decisions 


To build on this momentum, the CBSA has been developing an integrated, enterprise approach 
based on increasing our analytics maturity over the next three years. 


Our strategy is based on close collaboration between Operations, Programs, and Information 
Science and Technology supported by strong data governance to manage data as an enterprise 
asset while respecting security and privacy. 


support of our strategic objectives — facilitating trade, ensuring security of the border and 
promoting management excellence. 


The agency is using 
dedicated asa b 


а Center of Excellence approach with its Science and Engineering services 


ody of knowledge to advance exploration and capabilities 
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data analytics to fulfill its mandate to support pre-arrival risk 
dia, geospatial 


The CBSA is actively using 


information, and operational models. 


Examples include: 


— Operations research to improve scheduling of Border Service Officers and resource allocation. 
— Mathematical Algorithm development and logic model practice in progress and highly needed. 
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e Advanced statistical models to improve compliance testing , detect trade fraud, and 
support program optimization. 
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— streamlining processes, expediting availability of data for analytics 
— Managing privacy and security considerations, authority to release data 


— governing legacy data and open data is not converging rapidly 


3 B B ons Б Чеби Кы 


— small number of qualified analysts across the organization 
— academic and experience background matters in this domain 


— need to bring together data scientists and business analysts to break down silos and 
improve results 


— sustained commitment 
a Centre of Excellence is difficult to sell 


— business case to fund 
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information Security 


Security of paper and electronic information and records; 

Best practices, tools and processes for the protection of information of 
business value; 

Protection of classified information; 

Disposition of designated information; 

Guidance and advice for the protection of regional records and 
information. | : 


Learning Communities 
= Electronic environments for sharing of information and 


collaboration; 
* Environments for sharing articles of interest. 


All Employees 


" Organizing information for effective and efficient horizontal knowledge 
sharing, collaboration, retention and availability of corporate history, 
enterprise search, etc. 

Produce and consume our information. 
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° Information is a business resource (like people and money). Not managing it isn't a viable option. 


° The Agency renders decisions every minute using “information”. 


• Relatively modest IM 


program (less than 5 years really) 


° Basic IM services in place, transformation required to provide foundational business support (e.g. 
Human Resources, Finance, etc.) 


° Inconsistent IM practices across regions 


° Increase usability and value of our information in support of border operations 
nplement Open Government Services to Canadians 

° Compliance to the Government of Canada Information Management Policy suite 

° Continuously monitor, improve and innovate the Agency’s “Information Ecosystem’ 


3 


e Lack of Context 


° Lack 


Information Gove 


Outdated Prac Challenges. 


Lack of Context. Lack of Colla ora | io | 
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* Creation of Business Portfolio __ * Continue work towards * Develop Social Business 
information Agents to work _ compliance to the GC IM Platform capabilities 
directly with business clients | Policy Suite « Business Infomation Enablers 

Development of new IM Service. . * Enterprise Information project (i.e. Digitization, 

Model to provide foundational p Mapping and metadata electronic Workflows) 


business support strategy 


initiate clean up, read- : * Configuration of Apollo to 
only access and deletion of net enable collaboration and 
work and personal drives. в. knowledge sharing 


Continue Apollo roll-out and 
Business Optimization 
Regional engagement and 
standardization of practices 


e Develop a culture change 
management plan 


_ e Creation of Business Portfolio Information Agents to work directly with 
m business clients 


* Development of new IM Service Model to provide foundational 
business support 

e Initiate clean up, read-only access and deletion of network and 
personal drives. 


* Continue Apollo roll-out and Business Optimization 
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REFINE 
а ORGANIZE 
= INTERPRET 


° Information Analysts 
* Records Managers 
sen e Librarians 

IT e Archivists 

* Taxonomy Specialists 
• Information Architects 
* Technical Specialists 


Data Scientists 

Data Analysts 

e Data Architects 

° Taxonomy Specialists 
° Jechnical Specialists 
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Reporting - training and Sd 
» Program Integrity unit - risk assessment 


» Navona Border Operations Centre — applied 
anal lyties | in терро of sie situational 

> Regional Corporate Pron iram 1 Support Divisions — 

regional performance reporting and analysis 

> Intelligence — Data Exploitation Unit 


> HR Prodi rams — - workforce analysis (e.g. 
demographics, time utilization) and link to People 
strategy 
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Potential Business 
Case inputs 
funding pressures} 


| ffort between ISTB and Programs , working with 
Data Analytics Business Case / Action Plan ders to develop the business case and action plan 


Programs - GBMDA IMC in May 2016 
ISTB - EAIM EC in June 2016 


A cross-functional organization that brings together business, IT and 
analytical skills to make effective use of Business Analytics ISTB - EAIM in progress 
investments. 


siness Analytics Competency Centre 
CC) 


The establishment of accountability as well as clear roles and Programs - GBMDA 
responsibilities for managing data as a corporate asset ISTB - EAIM 


An initiative to assess, prioritize and address key data quality issues Programs - GBMDA 


A network of appointed Business Data Stewards working together to 


ensure CBSA data is fit for use as well as managing it throughout Programs - GBMDA Launch: April 2016 
the data lifecycle from planning to disposition. 


Enterprise Data Model (EDM) STB - EAIM Phase 2: April 2016 


Master Data Management (MDM) a "single version of the truth" thereby enabling the cross-integration 
of CBSA operational systems. 


ISTB - TPP Launch in Q1 2016-1 


release all eligible data within the Agency. This includes compliance 
deliverables such as a comprehensive inventory of the Agency's 
data and continued release of open data datasets 


Open Data ISTB-EAIM In Progress 
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porting 
IPR) Initiative 


Performance 
Measurement 
Framework 


Performance 


Cost Factor 
Manual (CFM) 
Resource m 
Allocation Mode! 
(RAM) 


leManifest 
[Temporary Resident 


Biometrics Program (TRBP) 
[Reporting 


(Enterprise Risk Assessment 
(Support Service (ERASS) 


Potential Busine 
Case Inputs 
(funding pressures) 


Business case in 
progress (June 
2016) 


Alignment of various reporting instruments (PMF, APS, MOB, CFM) to a universal of + Sees 
performance indicators that can support strategic, tactical and operational decision making. ia Ur 
Comptrollership 


A new corporate measurement framework based on the upcoming PAA changes (2017/18 


implementation) that is the basis for the annual Departmental Performance Report. een See 


A Quarterly management summary report that reports on Key Performance Indicators (KPI) Programs - Onaei 
E8 a. ngong 
as well as management tactical priorities. GBMDA 


from the AFS (Traveller, Commercial & Trade, Enforcement & Immigration) in the form of an GBMDA hi i iud Ri 
interactive web dashboard. ISTB - EAIM | 
Integration of operational (volumes), finance (expenditures) and HR (FTEs) data to deliver Comptrollership ~ 


activity-based costing of POE operations; supporting resource allocation planning, forecasting TO сор à 


CB - AC 
Programs in progress 
Ops 


A methodology of allocating resources for functional activities based on a given workload, 
performance levei and risk, and direct and indirect costs. 


In progress — Fall 
2016 project 
closure 


Programs - CP 
ISTB - CPP 


Statistical reporting pertaining to the biometric verification of temporary residents requiring Programs - TP 


visa to enter Canada. ISTB- TPP n progress 


Programs - TP 


ISTE - TPP Early phases 


A business service encompassing the search for information in support of risk assessment for Programs - TP 


all entities (e.g. travellers, trade chain partners, related parties, etc.) other than commodities. ISTB-TPP — ^ ioci 
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SAP Business Warehouse 
(BW) / Business, Planning & 
Consol idation (BPC) 

[CBSA Assessment and 
Revels Management 


Interactive Advanced 
|Раѕѕепсег Information (IAPI) 
Reporting 


Extraction of CAS data (CRA platform) to a CBSA financial data warehouse to support financial 
reporting and analytics, as well as the ability to integrate top-down/bottom-up planning, Comptrollership 
forecasting and budgeting activities (replacement of COMPASS and SFS). 


A large, multi-year project to transform how the CBSA assesses, collects, manages and reports Programs - TADP 
on import revenue and trade information. ISTB - CARM 


Statistical summary report of all —— passage records contained’ in the CBSA's repository Programs - TP 
ef entry records and exit records (Entry Exit information System [EXIS)). | ISTB - TPP 


| Programs -TP 
ISTB - TPP 


Programs - TP 
iSTB - TPP 


Statistical reporting and ean performance of hand- held wireless devices used to Бене Piógisihs- TP 
Primary Inspections of travellers. ISTB - TPP 


Providing the ability to report on various components including: receipt of inbound data from 

Importers and Brokers, use of hosted participating government agency or department business Prodr < CE 
rules to determine recommendations, receipt of PGA recommendations, execution of exams, | IST eee 
transmission of outbound Notices to trade chain partners, and Web metrics for Outreach page | 

hits. 


Providing ad-hoc and Bl capabilities to analyze the Pariners i in Protection (PIP) p program | | 
Programs - CP 
including system utilization, registration/activation, membership application lifecycle as well as ISTB - CPP 


the ability measure and monitor the execution and impact of business processes improvement. 


: System performance of RFID readers installed in Primary Inspection lanes used to automate Piddisiis - TP 


Launch in Q1 
2016-17 


Procurement 
planning in 
prodress 


Phase 2 in 
progress 
2018 


Phase 2 in 
progress 


In progress — 
release 


Interdiction & Border Alert 
System (IBAS) Reporting 


the retrieval of traveller identification documents. ISTE + TPP 


Providing replacement reporting functionality for the decommissioning of FOSS , pes CSIS Programs - EIP 
Lookouts, TUSCAN lookouts and Lost, Stolen and Fraudulent Documents (SFD), ISTB - EAIM 


_ management 
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Insight 


Analytics 
FOCUS 


Why didit thot is 
happen? heppening? 


interactive Reports! Dashboards, Predictive Models j 
On-line Analytical Alerts Strategy Maps 


_ Processing 


Analytics 
Output 


"Right-time" Past Events 


РОНА 


& Forecast E Analytics «үа паа 


са iperations/ 


Budget, Planning Diagnostic Situational 


е rement 


© 
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tes 


The ability to harvest, visualize, and disseminate operational Improved ability to react (anticipate) to real world events 
Situational and 3rd party information in near real-time as it relates to as they unfold to protect and secure Canada's borders as 
Awareness border operations (e.g. border traffic, use of force incidents, wel as improved border efficiency. 
(Operations/BOC) pandemics, etc.). 


The ability to dynamically answer three fundamental 
Performance questions regarding key business processes that affect | 
Measurement organizational performance: #1 “How аге we doing?”, #2 objectives to bottom-up needs). The ability to understand 
(All Branches) “Why did that happen?’ and #3 “What should we be doing?” the performance implications of managemeni decisions 

(strategic and tactical) and employee efforts (operational). 


Descriptive The ability to provide access to key sources of information Providing the agency with improved business agility 
Reporting & over time for the purpose of managing day-to-day operations (through timely access to reliable information) to support 


Diagnostic as well as gaining a better understanding of CBSA fact-based decision making as needs arise. Improved 


Analytics operations over time. turnaround for management, ministerial, ATIP requests for 
(All branches) information. 


rmal 
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Situational 
Awareness 
(Operations) 


Performance 
Measurement 
(All Branches) 


Descriptive 
Reporting & 
Diagnostic 
Analytics 
(All branches) 
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ISIS 
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